version tracking: tune annotations + add customManagers for linuxserver servarr

Several images were showing as outdated in version-checker / unhandled by
Renovate. Each had a distinct cause; this PR fixes the auto-tractable ones.

1) admin-system/renovate.yaml: bump `app.kubernetes.io/version` labels
   `43.197.0 -> 43.209.3` (3 occurrences) to match the live image.
   Renovate's own self-update PR bumped the image tag but left the
   labels stale; the version-checker widget appears to read the label.
   Long-term, this label will drift again on each self-update -- worth
   a customManager later if it becomes a recurring annoyance.

2) admin-system/renovate.yaml: add a customManager + packageRule pair
   for linuxserver servarr apps. Tag pattern is `version-X.Y.Z.B`
   (4 segments + `version-` prefix) which the kubernetes manager's
   default docker versioning rejects at the pre-check, same failure
   class as termix. Regex versioning parses the prefixed 4-segment
   form; the same customManager handles prowlarr/radarr/sonarr (depName
   captured from the regex). kubernetes-manager extraction for these
   three depnames is disabled via packageRule so the dashboard isn't
   cluttered with the failing fallback.

3) nextcloud-system/nextcloud.yaml: add
   `match-regex.version-checker.io/nextcloud: '^\d+\.\d+\.\d+-apache$'`
   so version-checker doesn't treat the bare `33.0.5` server tag as a
   newer version of our `33.0.5-apache` image. The widget was showing
   `33.0.5-apache -> 33.0.5` -- false positive; image is already current.

4) helm/plex/values.yaml: tighten the version-checker regex from
   `^\d+\.\d+\.\d+\.\d+-.*$` to `^\d+\.\d+\.\d+\.\d+-[a-f0-9]+$` so
   per-arch tags (`-armhf`, `-arm64`, ...) are excluded. The widget
   was showing an `-armhf` tag as "newer" than our x86_64 install.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

nextcloud-system/nextcloud.yaml

@@ -392,6 +392,9 @@ spec:
         nextcloud-config-hash: 06b49913be13b1f9a81745166dd75ada59e7ddd39e8f6a2c5538affe2a6d1093
         php-config-hash: 5a497358af870e06b42325eee83d7c0e5466b7f6819cb49b598559d96def7428
         hooks-hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
+        # Only match the `X.Y.Z-apache` variant tags so version-checker doesn't
+        # treat the bare `X.Y.Z` server tag as a "newer" version of our apache image.
+        match-regex.version-checker.io/nextcloud: '^\d+\.\d+\.\d+-apache$'
     spec:
       containers:
         - name: nextcloud