feat(plex): transcode resource discipline + admin knobs (E6 S1c)

The software-fallback re-encode now runs deprioritized and admin-configurable.
The SW transcode ffmpeg child is niced (preexec_fn → os.nice, applied per-child
because the Popen lives in the long-lived API process, which must NOT itself be
niced — unlike the download worker's whole-process _deprioritize) so a CPU-bound
re-encode can't starve request handling or playback; the VAAPI path needs none of
it.

New sysconfig knobs (plex group, rendered on the admin Configuration page, i18n
HU/EN): plex_transcode_hw (auto/on/off, layered onto _want_hw), plex_transcode_
preset, plex_transcode_crf, plex_transcode_max_height (software-only downscale-to
cap; the GPU path encodes at source resolution). plex_max_transcodes stays the
concurrency cap (comment corrected — the fallback is shipped, not "later").

pytest extends the command-builder + _want_hw coverage (preset/crf/max_height
plumbing, the on/off/auto policy). Browser-UAT'd: max_height=240 drops the live
resolution to 330x240; the SW ffmpeg child runs at nice 10 (ppid=api process).

backend/tests/test_plex_stream.py

@@ -228,27 +228,77 @@ class TestTranscodeCommand:
         assert "-var_stream_map" in cmd  # …but still multi-rendition (client-side audio switch)
         assert "copy" not in cmd
 
+    def test_software_preset_and_crf_come_from_the_knobs(self):
+        cmd = stream._ffmpeg_cmd(
+            self.SRC, 0.0, self.OUT, None, transcode=True, hw=False, preset="slow", crf=18
+        )
+        assert cmd[cmd.index("-preset") + 1] == "slow"
+        assert cmd[cmd.index("-crf") + 1] == "18"
+
+    def test_software_max_height_caps_with_a_downscale_only_filter(self):
+        cmd = stream._ffmpeg_cmd(
+            self.SRC, 0.0, self.OUT, None, transcode=True, hw=False, max_height=720
+        )
+        # Downscale-only, aspect-preserving, even width; the comma in min() escaped so it's ONE filter.
+        assert cmd[cmd.index("-vf") + 1] == "scale=-2:min(ih\\,720)"
+
+    def test_software_max_height_zero_means_no_scale_filter(self):
+        cmd = stream._ffmpeg_cmd(
+            self.SRC, 0.0, self.OUT, None, transcode=True, hw=False, max_height=0
+        )
+        assert "-vf" not in cmd  # source resolution kept
+
+    def test_hardware_ignores_max_height(self):
+        # The GPU encode is cheap, so it runs at source resolution; max_height is a software-only knob.
+        cmd = stream._ffmpeg_cmd(
+            self.SRC, 0.0, self.OUT, None, transcode=True, hw=True, max_height=720
+        )
+        assert cmd[cmd.index("-vf") + 1] == "scale_vaapi=format=nv12"  # not a software scale
+
 
 class TestWantHw:
-    """VAAPI is used only where the render node was passed in AND the source is HW-decodable."""
+    """VAAPI is used only where the render node was passed in AND (in auto) the source is HW-decodable,
+    with an admin `plex_transcode_hw` policy (auto/on/off) on top."""
+
+    @staticmethod
+    def _policy(monkeypatch, mode):
+        monkeypatch.setattr(stream.sysconfig, "get_str", lambda db, k: mode)
 
     def test_no_hw_when_not_transcoding(self, monkeypatch):
+        self._policy(monkeypatch, "auto")
         monkeypatch.setattr(stream, "_render_node_present", lambda: True)
-        assert stream._want_hw(_FakeItem(codec_video="hevc"), transcode=False) is False
+        assert stream._want_hw(None, _FakeItem(codec_video="hevc"), transcode=False) is False
 
     def test_no_hw_without_a_render_node(self, monkeypatch):
+        self._policy(monkeypatch, "auto")
         monkeypatch.setattr(stream, "_render_node_present", lambda: False)
-        assert stream._want_hw(_FakeItem(codec_video="hevc"), transcode=True) is False
+        assert stream._want_hw(None, _FakeItem(codec_video="hevc"), transcode=True) is False
 
-    def test_hw_for_a_decodable_source_with_the_render_node(self, monkeypatch):
+    def test_auto_uses_hw_for_a_decodable_source_with_the_render_node(self, monkeypatch):
+        self._policy(monkeypatch, "auto")
         monkeypatch.setattr(stream, "_render_node_present", lambda: True)
-        assert stream._want_hw(_FakeItem(codec_video="hevc"), transcode=True) is True
+        assert stream._want_hw(None, _FakeItem(codec_video="hevc"), transcode=True) is True
 
-    def test_software_for_a_non_decodable_source_even_with_the_render_node(self, monkeypatch):
+    def test_auto_falls_back_to_software_for_a_non_decodable_source(self, monkeypatch):
         # AV1 / MPEG-4 ASP (XviD) aren't decodable on Gen 9.5 → the GPU can't feed its own encoder.
+        self._policy(monkeypatch, "auto")
         monkeypatch.setattr(stream, "_render_node_present", lambda: True)
-        assert stream._want_hw(_FakeItem(codec_video="av1"), transcode=True) is False
-        assert stream._want_hw(_FakeItem(codec_video="mpeg4"), transcode=True) is False
+        assert stream._want_hw(None, _FakeItem(codec_video="av1"), transcode=True) is False
+        assert stream._want_hw(None, _FakeItem(codec_video="mpeg4"), transcode=True) is False
+
+    def test_off_forces_software_even_for_a_decodable_source(self, monkeypatch):
+        self._policy(monkeypatch, "off")
+        monkeypatch.setattr(stream, "_render_node_present", lambda: True)
+        assert stream._want_hw(None, _FakeItem(codec_video="hevc"), transcode=True) is False
+
+    def test_on_forces_hw_even_for_a_non_decodable_source(self, monkeypatch):
+        # The admin override trusts the GPU to decode it; skips the decodability gate (render node still
+        # required — HW is impossible without it).
+        self._policy(monkeypatch, "on")
+        monkeypatch.setattr(stream, "_render_node_present", lambda: True)
+        assert stream._want_hw(None, _FakeItem(codec_video="av1"), transcode=True) is True
+        monkeypatch.setattr(stream, "_render_node_present", lambda: False)
+        assert stream._want_hw(None, _FakeItem(codec_video="hevc"), transcode=True) is False
 
 
 class TestColdStartWarmup: