fix(plex): the reclaim window rolls, and a refused finish is not performed through a third route

Two ways round 6's own fixes did not bound what their comments said they bounded.

The reclaim budget's window anchor was written only where the window RESET, so it marked the window's
start rather than the last loss — a tumbling window, not the rolling one the constant is named for.
Any loss cadence slower than half the window satisfied the reset on every second loss, so the budget
never reached its bound: measured over 200 loss cycles, 61/70/90/119s apart all gave 200 reclaims and
never an error, while 5s and 30s apart correctly gave two and then the honest answer. The failing
band is exactly the case the ERROR handler names — a transcode that falls behind realtime — and both
committed tests spaced their losses 0s and 10min apart, i.e. outside it. The anchor now moves with
every loss.

And `finish`'s refusal handler lowered the play-through latch, which is the only gate on the 10s
interval, the page-hide beacon and `settle`. All three post `absRef`, which on the play-to-the-end
path IS the end of the media, and the backend reads a position within `_FINISH_MARGIN_S` of the
duration as a finish — so within ten seconds of the toast saying the mark had failed, the item was
marked watched, its position cleared and a scrobble sent to Plex. Round 6 closed the explicit
rollback write and left the other three open; the test it added set `upNext: false`, which tears the
effect down before any of them can fire. The refusal now takes back the CLAIM rather than the latch:
a second flag stops `settle` re-asserting watched, and playing again clears both.

`FINISH_MARGIN_S` duplicated the backend's constant in a second language with nothing relating them,
and its comment had the asymmetry backwards — if the BACKEND's margin grows, this guard starts
admitting a rollback the backend reads as a finish, i.e. re-opens the defect above. Pinned by a
contract test that reads the Python, and the comment corrected.

frontend/src/components/PlexPlayer.hls.dom.test.tsx

@@ -220,6 +220,34 @@ describe("an HLS session the server no longer has", () => {
     }
   });
 
+  it("gives up on a session lost over and over on a SLOW cadence too", async () => {
+    // The window's anchor used to be written only where the window RESET, so it marked the start of
+    // the window instead of the last loss — a tumbling window, not the rolling one the constant is
+    // named for. Any cadence slower than half the window then cleared the budget on every second
+    // loss and the bound never bit: a transcode falling ~70s behind realtime — the case the ERROR
+    // handler itself names — reclaimed forever (measured: 200 losses 70s apart → 200 reclaims,
+    // never an error). The two cases above space their losses 0s and 10min apart, i.e. both sit
+    // outside the 60–120s band where the defect lived (deep-review round 7).
+    vi.useFakeTimers({ shouldAdvanceTime: true, toFake: ["Date"] });
+    try {
+      const session = mount();
+      const v = () => document.querySelector("video") as Media;
+      for (let i = 0; i < 6 && !screen.queryByText("plex.player.errGeneric"); i++) {
+        await waitFor(() => expect(hlsInstances).toHaveLength(i + 1));
+        act(() => hlsInstances[i]!.emit(Hls.Events.MANIFEST_PARSED));
+        v()._t = 700;
+        act(() => void v().dispatchEvent(new Event("timeupdate")));
+        act(() => hlsInstances[i]!.emit(Hls.Events.ERROR, lost404));
+        act(() => void vi.setSystemTime(Date.now() + 70_000));
+      }
+      await screen.findByText("plex.player.errGeneric");
+      // Two reclaims, each within two minutes of the loss before it — then the honest answer.
+      expect(session).toHaveBeenCalledTimes(3);
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+
   it("is a failure, not a restart, when the session never played", async () => {
     // Otherwise a session that 404s from the start would restart itself in a loop.
     const session = mount();