E5 S4: Plex Discover rail-surface (default landing)

A dedicated Plex "Discover" landing — a stack of horizontal Carousel rails
served from ONE consolidated read (serve-from-DB, no live Plex/TMDB call):

- GET /api/plex/discover → continue_watching (in-progress movies + shows, most
  recently progressed) · recently_added · genres (top-N tiles) ·
  because_you_watched (recs of the most-recent watched, TMDB-enriched movie,
  resolved to library rows by guid via serve_block's resolver).
- GET /api/plex/surprise → a fresh random, scope-bounded sample for the ↻ rail.

Frontend: PlexDiscover.tsx (rails reuse the S1 Carousel + S3 PlexPosterCard;
colored genre tiles → tap to filter the grid; ↻ reshuffles the surprise rail
alone). Discover is now the root sub-view; the flat grid becomes the bookmarkable
"Browse all" secondary view (?v=browse) reached by a header search/filter (a
browse-intent flip) or the new Discover⟷Browse toggle.

resolve_recs is promoted from _resolve_recs (now cross-module). Tests:
test_plex_discover.py (rail shape/order, continue-watching, because-you-watched
+ null, surprise bounds, scope) and PlexDiscover.dom.test.tsx; plexSubUrl
round-trip updated for discover-root/grid-browse. Backend lane 393, vitest 332.

frontend/src/lib/queryKeys.ts

@@ -93,6 +93,12 @@ export const qk = {
   plex: () => ["plex"] as const,
   plexWatchLink: () => ["plex-watch-link"] as const,
   plexLibrary: (...rest: unknown[]) => ["plex-library", ...rest],
+  // Discover surface (E5 S4): the rail payload keyed by scope+lang; `plexDiscover()` (no args) matches
+  // both for a prefix invalidation after a watched-toggle. Surprise is its own key so the ↻ reshuffle
+  // refetches it alone.
+  plexDiscover: (...rest: unknown[]) => ["plex-discover", ...rest],
+  plexSurprise: (scope?: string) =>
+    scope !== undefined ? (["plex-surprise", scope] as const) : (["plex-surprise"] as const),
   plexSuggest: (...rest: unknown[]) => ["plex-suggest", ...rest],
   // Optional trailing `lang` (E5 S6): a language switch remounts the detail with a new key so HU/EN
   // metadata is cached separately. Omitting it (e.g. for a prefix invalidation) still matches both.