version tracking: tune annotations + add customManagers for linuxserver servarr

Several images were showing as outdated in version-checker / unhandled by
Renovate. Each had a distinct cause; this PR fixes the auto-tractable ones.

1) admin-system/renovate.yaml: bump `app.kubernetes.io/version` labels
   `43.197.0 -> 43.209.3` (3 occurrences) to match the live image.
   Renovate's own self-update PR bumped the image tag but left the
   labels stale; the version-checker widget appears to read the label.
   Long-term, this label will drift again on each self-update -- worth
   a customManager later if it becomes a recurring annoyance.

2) admin-system/renovate.yaml: add a customManager + packageRule pair
   for linuxserver servarr apps. Tag pattern is `version-X.Y.Z.B`
   (4 segments + `version-` prefix) which the kubernetes manager's
   default docker versioning rejects at the pre-check, same failure
   class as termix. Regex versioning parses the prefixed 4-segment
   form; the same customManager handles prowlarr/radarr/sonarr (depName
   captured from the regex). kubernetes-manager extraction for these
   three depnames is disabled via packageRule so the dashboard isn't
   cluttered with the failing fallback.

3) nextcloud-system/nextcloud.yaml: add
   `match-regex.version-checker.io/nextcloud: '^\d+\.\d+\.\d+-apache$'`
   so version-checker doesn't treat the bare `33.0.5` server tag as a
   newer version of our `33.0.5-apache` image. The widget was showing
   `33.0.5-apache -> 33.0.5` -- false positive; image is already current.

4) helm/plex/values.yaml: tighten the version-checker regex from
   `^\d+\.\d+\.\d+\.\d+-.*$` to `^\d+\.\d+\.\d+\.\d+-[a-f0-9]+$` so
   per-arch tags (`-armhf`, `-arm64`, ...) are excluded. The widget
   was showing an `-armhf` tag as "newer" than our x86_64 install.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

helm/plex/values.yaml

@@ -235,7 +235,10 @@ statefulSet:
   annotations: {}
   # -- Optional extra annotations to add to the pods in the statefulset
   podAnnotations: 
-    match-regex.version-checker.io/plex-plex-media-server-pms: ^\d+\.\d+\.\d+\.\d+-.*$
+    # Match only `<X.Y.Z.B>-<short-hash>` (the amd64/native tag form) and exclude
+    # per-arch tags (e.g. `-armhf`, `-arm64`) so version-checker doesn't show an
+    # ARM tag as "newer" than our x86_64 install.
+    match-regex.version-checker.io/plex-plex-media-server-pms: '^\d+\.\d+\.\d+\.\d+-[a-f0-9]+$'
 
 service:
   type: LoadBalancer