fix(plex): address S1 review round-2 findings

- by_rating_key: generic-typed (type[_M] -> _M | None) so call sites keep their
  Model | None static type.
- Migrate the last 2 open-coded PlexCollection-by-rating_key lookups (sync.py
  resync_collection + delete_collection_local) to by_rating_key; zero open-coded
  rating_key lookups now remain in the package.
- Add test_playlist_bulk_add_and_remove covering the bulk add/remove endpoints
  and pinning the remove-bulk synchronize_session=False path.

Full suite 258 passed, 2 skipped; ruff clean.

backend/app/plex/lookups.py

@@ -1,11 +1,16 @@
 """Small shared Plex row lookups, so the get-by-rating_key pattern lives in one place."""
+from typing import TypeVar
+
 from sqlalchemy import select
 from sqlalchemy.orm import Session
 
+_M = TypeVar("_M")
 
-def by_rating_key(db: Session, model, rating_key: str):
+
+def by_rating_key(db: Session, model: type[_M], rating_key: str) -> _M | None:
     """The mirrored row for a Plex rating_key, or None. `model` is any of the rating_key-keyed Plex
-    tables (PlexItem / PlexShow / PlexSeason / PlexCollection)."""
+    tables (PlexItem / PlexShow / PlexSeason / PlexCollection); the return type is that model, so call
+    sites keep their `Model | None` static type."""
     return db.execute(
         select(model).where(model.rating_key == str(rating_key))
     ).scalars().first()