The Pirate Phase 1.b extension: Plex tools

Adds 4 read-only Plex tools using a new plex_get helper that sends
X-Plex-Token as a query param and Accept: application/json:
- plex_library_sections: per-section item counts
- plex_on_deck: in-progress items across all libraries
- plex_watch_history: recent watches with user-name resolution via /accounts
- plex_recently_added: latest additions across sections

Token sourced from Plex registry on Darrow (HKU per-user hive). Stored
in service_configs.plex. Plex paginated counts require BOTH
X-Plex-Container-Start and X-Plex-Container-Size in query string to
return totalSize — dropping Start makes Plex return the full library.

Pirate catalog: 20 → 24 tools.

agents/pirate/tools/_common.py

@@ -33,6 +33,22 @@ def arr_get(service_name, path, params=None):
         return json.loads(resp.read().decode())
 
 
+def plex_get(path, params=None):
+    """GET from the Plex API. Auth is via X-Plex-Token query param; returns JSON."""
+    cfg = get_service_config("plex")
+    base = cfg["base_url"].rstrip("/")
+    key = cfg["api_key"]
+    if not base or not key:
+        raise RuntimeError("plex not configured (base_url + api_key required)")
+    merged = {"X-Plex-Token": key}
+    if params:
+        merged.update(params)
+    url = f"{base}{path}?" + urlparse.urlencode(merged, quote_via=urlparse.quote)
+    req = urlreq.Request(url, headers={"Accept": "application/json"})
+    with urlreq.urlopen(req, timeout=15) as resp:
+        return json.loads(resp.read().decode())
+
+
 def qbit_request(path, method="GET", params=None, data=None, cookies=None):
     """qBittorrent Web API helper. Login (if password set) returns SID cookie string."""
     cfg = get_service_config("qbittorrent")