refactor(plex): convert service-layer db.query() to 2.0 select() (wave 1)

Mechanical 1.x->2.0 conversion of the self-contained plex modules, behaviour-
equivalent (the characterization net + existing plex tests stay green, 39
passed): app/plex/{sync(15),watch_sync(9),people(1),imgcache(4)} and
app/routes/plex/{admin(4),playback(8),_shared(1)}. Query builders become
select(); .first()/.all()->execute().scalars(); a bulk .update() ->
execute(update()); a single-column .first() -> db.scalar().

browse.py (61) + rollup.agg_subquery (the atomic unit with unified_library)
remain for wave 2.

backend/app/routes/plex/admin.py

@@ -4,6 +4,7 @@ from datetime import datetime, timezone
 
 from fastapi import APIRouter, Depends, HTTPException
 from pydantic import BaseModel
+from sqlalchemy import select
 from sqlalchemy.orm import Session
 
 from app import sysconfig
@@ -65,9 +66,9 @@ def _sample_plex_path(
     """A real Plex-side media file path to validate the mount + path-map against. Prefers the
     already-mirrored catalog (cheap); before the first sync, pulls one movie leaf from an enabled
     section straight from Plex."""
-    row = db.query(PlexItem.file_path).filter(PlexItem.file_path.isnot(None)).first()
-    if row and row[0]:
-        return row[0]
+    fp = db.scalar(select(PlexItem.file_path).where(PlexItem.file_path.isnot(None)))
+    if fp:
+        return fp
     wanted = plex_sync._enabled_section_keys(db)
     for s in sections:
         if s.get("type") != "movie":
@@ -117,7 +118,9 @@ def watch_link_status(
     user: User = Depends(current_user), db: Session = Depends(get_db)
 ) -> dict:
     """This user's Plex watch-sync link status (drives the Settings toggle)."""
-    link = db.query(PlexLink).filter_by(user_id=user.id).first()
+    link = db.execute(
+        select(PlexLink).where(PlexLink.user_id == user.id)
+    ).scalars().first()
     return _link_dict(link)
 
 
@@ -137,7 +140,9 @@ def watch_link_set(
     if not sysconfig.get_bool(db, "plex_enabled"):
         raise HTTPException(status_code=409, detail="The Plex module is disabled.")
     enabled = body.enabled
-    link = db.query(PlexLink).filter_by(user_id=user.id).first()
+    link = db.execute(
+        select(PlexLink).where(PlexLink.user_id == user.id)
+    ).scalars().first()
     if link is None:
         link = PlexLink(
             user_id=user.id, uses_admin=True, linked_at=datetime.now(timezone.utc)
@@ -158,7 +163,9 @@ def watch_import_now(
 ) -> dict:
     """Admin: (re-)run the "Plex is master" import for this account — Plex re-wins on the
     intersection; Siftlode-only states are preserved. Idempotent."""
-    link = db.query(PlexLink).filter_by(user_id=user.id).first()
+    link = db.execute(
+        select(PlexLink).where(PlexLink.user_id == user.id)
+    ).scalars().first()
     if link is None or not link.sync_enabled:
         raise HTTPException(status_code=409, detail="Enable Plex watch-sync first.")
     result = plex_watch.import_owner_watch_state(db, link)