Stop labelling unrelated errors as Plex authentication failures

[rowkav09]

Fixes #210. SyntaxError -> upstream_response (retryable, bounded by the normal job retries); bare 'token' no longer means authentication unless the message names Plex. PlexConnectionError handling is unchanged. Two fail-first cases added.

[rowkav09]

Approving head d5ce7c7.

Merged with main, worker + plex suites pass (16 files, 118 tests). Fail-first: with main's library-sync.ts under the PR's tests, both new cases fail (SyntaxError and the uuid "bad token" error come back as authentication).

Probes through sanitiseSyncFailure, old vs new, 17 inputs. Changed as intended: SyntaxError (also with a secret-looking message, and subclasses) -> upstream_response, retryable, with the fixed summary so the message text never leaks; TypeError/RangeError/uuid error/bare "token expired" with no Plex mention -> unknown, retryable; "timeout fetching token" -> upstream_unavailable, retryable. Unchanged: PlexConnectionError UNAUTHENTICATED, "Invalid Plex token", "PLEX TOKEN expired", "missing X-Plex-Token header", Unauthorized, Forbidden, credential -> authentication, non-retryable; encryption/configuration unchanged; the plain string "token=secret-value" stays unknown.

The only place that throws a real token rejection is PlexConnectionError('UNAUTHENTICATED') in packages/plex/src/client.ts, so narrowing the substring match to "plex" + "token" doesn't lose a real auth case I could find.

Small note: any SyntaxError thrown anywhere in the sync (including a bug in our own JSON.parse) is now labelled as a Plex upstream response and retried. That's bounded by the normal retry limits and the summary is safe, so fine.

CI not green when I looked: CodeFactor and ghostdeps checks passed, "Verify TypeScript workspace" was still running. Same-account review.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!