chore(server): diagnose Plex HLS session identities

[KyleTryon]

Summary

• Replaces the speculative Plex HLS header change with diagnostic-only instrumentation.
• Keeps current HLS semantics stable: preview handles continue to use stored Plex playback session metadata; no synthetic segment header change.
• Adds structured Plex identity logs for sessionKey, Session.id/location, Player.machineIdentifier/product/platform, selected header source, Cliparr preview transcode id, and subtitle transcode id.
• Adds safe transcode request and playlist rewrite logs with sanitized paths, whitelisted query fields, upstream status/content type, and HLS segment ids.
• Adds env-gated CLIPARR_ENABLE_PLEX_HLS_PROBE=1 route: POST /api/debug/plex/hls-probe for authenticated sessions. The route returns 404 while disabled.

Validation

• pnpm --filter @cliparr/server exec node --import tsx --test src/providers/plexPlayback.test.ts src/routes/debug.test.ts src/providers/mediaProxy.test.ts
• pnpm preflight reached server tests but failed twice in unrelated existing src/db/providerPersistence.test.ts token ownership assertions:
  • merges Plex account components bridged by a repeated login: expected phone-user-token, got second-user-token
  • deduplicates Plex sources across logins with different user tokens: expected phone-user-token, got desktop-user-token
• pnpm --filter @cliparr/server exec node --import tsx --test src/db/providerPersistence.test.ts also fails in isolation with those same two assertions.