fix(plex): give the sweep's boot-time cutoff cross-clock slack

Found by running the round-8 fix in the real container instead of trusting the
unit test: a directory created 2ms AFTER `_PROCESS_START` was stamped with an
mtime 2ms BEFORE it, so the sweep deleted it as a leftover. The two sides come
from different clocks — a file's mtime from the kernel's coarse clock (one timer
tick of lag), `time.time()` from the fine one — and the unit test could not see it
because it supplies an artificial cutoff.

The window is small and lands exactly where it hurts: the sweep runs at boot, so
the session at risk is one started in the first instants after startup — the case
the guard exists for. Keep-side slack of 2s; the cost is that a leftover from the
last seconds before a restart survives until the next one.

Verified in the container: a backdated leftover is swept, a directory created by
this run is kept, and a registered live session with an old mtime is kept — 1 of 3.
Test pins the skew (mutation-checked: with the grace at 0 it goes red).

backend/tests/test_plex_stream.py

@@ -126,10 +126,21 @@ class TestSweepOrphans:
         # The parameter exists for the tests; production calls it with no argument, so pin what
         # that means — otherwise the guard above could be right and unused.
         d = _session_dir(hls_root, "12345_0_None_+0.00")
+        monkeypatch.setattr(stream, "_MTIME_GRACE_S", 0.0)
         monkeypatch.setattr(stream, "_PROCESS_START", d.stat().st_mtime + 1)
         assert stream.sweep_orphans() == 1  # "older than boot" → swept
         assert not d.exists()
 
+    def test_a_directory_stamped_just_before_boot_survives(self, hls_root, monkeypatch):
+        # MEASURED in the container, not theory: a file's mtime comes from the kernel's COARSE
+        # clock and `time.time()` from the fine one, so a directory created 2ms AFTER
+        # `_PROCESS_START` was stamped 2ms BEFORE it. Without the grace the sweep deletes a session
+        # that started in the first instants after boot — which is exactly when the sweep runs.
+        d = _session_dir(hls_root, "12345_0_None_+0.00")
+        monkeypatch.setattr(stream, "_PROCESS_START", d.stat().st_mtime + 0.05)  # the skew
+        assert stream.sweep_orphans() == 0
+        assert d.exists()
+
     def test_a_missing_root_is_not_an_error(self, tmp_path, monkeypatch):
         monkeypatch.setattr(stream, "_HLS_ROOT", tmp_path / "nope")
         monkeypatch.setattr(stream, "_sessions", {})