Bug: Plex login fails when “Allow friends to authenticate” is enabled

### Describe the bug

Full disclosure: AI helped me diagnose the problem and create the workaround, and write this bug report.

### Summary

When a Plex source has “Allow friends to authenticate via Plex, even if you don't share any servers” enabled, all Plex authentication fails.

### Environment

- authentik: 2026.5.6
- Deployment: Docker
- Plex source has an allowed server configured

### Workaround

Disabling “Allow friends to authenticate…” immediately restores Plex authentication through the configured allowed-server check.

### Suggested fix

Catch `RequestException` around `get_friends()`, log the failure, and return `False` so the existing allowed-server check can continue.

### How to reproduce

1. In Federation and Social login, create a Plex Source to login via plex.
2. Enable “Allow friends to authenticate via Plex, even if you don't
share any servers.”
2. Attempt to authenticate using Plex.
3. Plex authorization completes.
4. authentik displays “Response returned an error code.” and prevents login.

### Expected behavior

Failure of Plex's friends endpoint should not abort the entire login. authentik should fail closed for friend-only authorization and continue checking whether the user shares an allowed server.

The Plex owner should also be recognized before calling the friends endpoint.

### Screenshots

_No response_

### Additional context

_No response_

### Deployment Method

Docker

### Version

2026.5.6

### Relevant log output

```shell
I couldn't figure out how to get unsanitized logs, so:

The Plex user lookup succeeds:

- `GET https://plex.tv/api/v2/user` → HTTP 200

authentik then requests:

- `GET https://plex.tv/api/v2/friends` → HTTP 410 Gone

The resulting request to:

- `/api/v3/sources/plex/redeem_token/?slug=plex-login`

returns HTTP 405.
```

Search the Plex source implementation for get_friends() and the redeem-token authentication flow. Inspect how a 410 response from Plex’s friends endpoint affects the existing allowed-server check, including Plex-owner handling. Done means friend lookup failure does not abort authentication, friend-only access fails closed, and an allowed-server user can still log in.

Written by the indexing model from the issue text.