fix(plex,audit): E30 review round 2 — only a missing file is a dead headshot, one spelling per portrait

- warm_portraits: only 404/410 mark a headshot dead (measured: Plex answers a dead CDN file 404);
  a refused token or a 5xx is Plex failing, ends the run after three in a row and marks nothing.
  'failed' counts every failure, not only the current streak.
- is_portrait_url: plain path segments only — no dot or empty segment an HTTP client folds onto
  one file; person_thumb_url uses the same predicate (27 852 stored headshots all pass).
- Tests: Plex refusing (401/403/429/5xx), failures between successes (portraits and bios), the kept
  original served from cache, the audit_clear / demo_reset / discovery_purge rows' counts as data,
  and the 0094 backfill on real rows.

backend/app/plex/people.py

@@ -29,9 +29,7 @@ PERSON_IMG_HOST = "https://metadata-static.plex.tv/"
 def person_thumb_url(thumb: str | None) -> str | None:
     """Proxied /person-image URL for a Plex CDN headshot, or None when it's missing / off-CDN."""
     t = str(thumb or "")
-    return (
-        f"/api/plex/person-image?u={quote(t, safe='')}" if t.startswith(PERSON_IMG_HOST) else None
-    )
+    return f"/api/plex/person-image?u={quote(t, safe='')}" if is_portrait_url(t) else None
 
 
 def cast_from_meta(meta: dict, limit: int = 24) -> list[dict]:
@@ -169,13 +167,15 @@ def people_by_credits(
 # a new box re-caches instead of serving a stale size. Only a resized image is ever written under it —
 # an original fetched without Plex keeps its own key, and goes once its small twin lands.
 PORTRAIT_BOX = 320
-# A headshot Plex answered with an error for (a dead CDN file) is not asked for again this long, so a
+# A headshot Plex answered "not found" for (a dead CDN file) is not asked for again this long, so a
 # few dead faces never hold up the rest of the prefetch.
 PORTRAIT_RETRY = timedelta(days=7)
-# The one shape a Plex CDN headshot has (…/7/people/<hash>.jpg): no query, no fragment. The
-# person-image proxy takes nothing else, so it cannot be made to cache endless variants of one file
-# (the image cache has no eviction).
-_PORTRAIT_URL = re.compile(re.escape(PERSON_IMG_HOST) + r"[A-Za-z0-9_./-]+")
+# The one shape a Plex CDN headshot has (…/7/people/<hash>.jpg): plain path segments, no query, no
+# fragment, no dot segment or empty segment (an HTTP client folds `a/../b` and the CDN `a//b` onto one
+# file). The person-image proxy takes nothing else, so it cannot be made to cache endless spellings of
+# one file (the image cache has no eviction). Used where a stored headshot is made, served and warmed.
+_SEGMENT = r"[A-Za-z0-9_-]+(?:\.[A-Za-z0-9_-]+)*"  # a name, dots only between its parts
+_PORTRAIT_URL = re.compile(re.escape(PERSON_IMG_HOST) + _SEGMENT + rf"(?:/{_SEGMENT})*")
 
 
 def is_portrait_url(url: str) -> bool:
@@ -219,15 +219,17 @@ def cdn_url(photo_thumb: str) -> str | None:
     return url if is_portrait_url(url) else None
 
 
-# Plex not answering this many headshots in a row ends a run: it is Plex that is failing, not the files.
+# Plex failing this many headshots in a row ends a run: it is Plex that is failing, not the files.
 _PLEX_DOWN_AFTER = 3
+# The statuses that mean the one file is gone.
+_DEAD = frozenset({404, 410})
 
 
 def warm_portraits(db: Session, limit: int) -> dict:
     """Cache up to `limit` not-yet-cached headshots, the most-credited people first (E30 S6), so a
     person's face comes from local disk. Needs Plex (the resize) and the Plex module on; without them
     nothing is prefetched — full-size originals for every person would cost gigabytes. A headshot Plex
-    answers with an error for is marked and left for PORTRAIT_RETRY; Plex not answering ends the run."""
+    answers "not found" for is marked and left for PORTRAIT_RETRY; Plex failing in a row ends the run."""
     if not sysconfig.get_bool(db, "plex_enabled"):
         return {"cached": 0, "skipped": "disabled"}
     try:
@@ -242,7 +244,7 @@ def warm_portraits(db: Session, limit: int) -> dict:
         ).tuples()
         if thumb
     }
-    done = dead = down = 0
+    done = dead = plex_failed = down = 0  # `down` counts in a row, `plex_failed` in all
     with plex:
         for pid in people_by_credits(db, "portrait", None):
             if done + dead >= limit or down >= _PLEX_DOWN_AFTER:
@@ -257,12 +259,15 @@ def warm_portraits(db: Session, limit: int) -> dict:
                 cache_portrait(plex, url)
                 done, down = done + 1, 0
             except PlexError as exc:
-                # An error status is Plex's answer about this one file; no answer is Plex itself.
-                if isinstance(exc.__cause__, httpx.HTTPStatusError):
+                # "Not found" is Plex's answer about this one file (a dead CDN headshot: measured 404,
+                # the CDN itself says 403). Anything else — no answer, a refused token, a 5xx — is
+                # Plex failing, which must neither mark the file nor keep the run going.
+                cause = exc.__cause__
+                if isinstance(cause, httpx.HTTPStatusError) and cause.response.status_code in _DEAD:
                     dead += 1
                     imgcache.mark_miss(key)
                 else:
-                    down += 1
+                    plex_failed, down = plex_failed + 1, down + 1
                 log.warning(
                     "a portrait could not be cached",
                     extra=logs.event(
@@ -271,5 +276,5 @@ def warm_portraits(db: Session, limit: int) -> dict:
                         reason=type(exc.__cause__).__name__,
                     ),
                 )
-    failed = dead + down
+    failed = dead + plex_failed
     return {"cached": done, **({"failed": failed} if failed else {})}