refactor(fe): migrate plex/messaging/admin/downloads/notifications to qk (R7 S2b)

Extend lib/queryKeys.ts to the remaining ~34 key roots and migrate every
remaining literal (queryKey: [...] AND the positional useLiveQuery keys) in
36 files. All ~200 React Query keys across the app now route through the
factory; zero raw key literals remain outside queryKeys.ts.

The heterogeneous composite plex keys (plex-library/facets/collections/
playlists carry a filters object, a ratingKeys array, or a union/group
discriminator) take a variadic pass-through — the factory centralizes the
ROOT string; single-id keys stay precisely typed. Nullable keys (thread,
playlist, ytSearch) accept null so a null segment is preserved.

Pure substitution — byte-identical key arrays, so TanStack prefix matching
is unchanged. Gate green: typecheck (app+node+e2e), eslint (0 err),
prettier, 68 vitest. Runtime-verified on a fresh dev server: Feed + Plex
modules load, feed/facets/tags/my-status/plex-library/plex-facets/
plex-collections/plex-playlists all 200, full UI renders.

frontend/src/components/KeyGate.tsx

@@ -1,4 +1,5 @@
 import { useState } from "react";
+import { qk } from "../lib/queryKeys";
 import { useTranslation } from "react-i18next";
 import { useQuery, useQueryClient } from "@tanstack/react-query";
 import { AlertTriangle, Lock, ShieldCheck } from "lucide-react";
@@ -16,15 +17,15 @@ export default function KeyGate({ meId, compact = false }: { meId: number; compa
   const { t } = useTranslation();
   const qc = useQueryClient();
   const keyQ = useQuery({
-    queryKey: ["message-key"],
+    queryKey: qk.messageKey(),
     queryFn: api.messageMyKey,
     staleTime: 60_000,
   });
   const configured = keyQ.data?.configured ?? false;
   // Password accounts must re-verify to reset (guards a hijacked session); Google-only accounts
-  // have no password to check. Reactive passive observer of the App-owned ["me"] query (enabled:
+  // have no password to check. Reactive passive observer of the App-owned qk.me() query (enabled:
   // false — App does the fetching), so hasPassword stays correct even if me resolves after mount.
-  const meQ = useQuery({ queryKey: ["me"], queryFn: api.me, enabled: false });
+  const meQ = useQuery({ queryKey: qk.me(), queryFn: api.me, enabled: false });
   const hasPassword = meQ.data?.has_password ?? false;
 
   const [view, setView] = useState<"gate" | "reset">("gate");
@@ -46,7 +47,7 @@ export default function KeyGate({ meId, compact = false }: { meId: number; compa
         const payload = await e2ee.setup(meId, pass);
         await api.setupMessageKey(payload);
       }
-      qc.invalidateQueries({ queryKey: ["message-key"] });
+      qc.invalidateQueries({ queryKey: qk.messageKey() });
     } catch {
       setErr(configured ? t("messages.wrongPass") : t("messages.setupFailed"));
     } finally {
@@ -77,7 +78,7 @@ export default function KeyGate({ meId, compact = false }: { meId: number; compa
       await e2ee.resetLocal(meId);
       setCurPass("");
       setView("gate");
-      qc.invalidateQueries({ queryKey: ["message-key"] });
+      qc.invalidateQueries({ queryKey: qk.messageKey() });
     } catch (e) {
       setErr(e instanceof HttpError && e.detail ? e.detail : t("messages.resetFailed"));
     } finally {