Promote Tautulli to the primary watch-history source

Tautulli is running at 192.168.1.100:8181, so watch data now comes from
get_history rather than Plex's session history. This matters beyond
convenience: Plex records that a play started, Tautulli records how far it
got. A film three people abandoned after five minutes and a film nobody ever
opened are opposite signals for a deletion decision, and Plex reports them
identically.

- Adds sections 4.8-4.11: Tautulli ingest, completion semantics, fallback,
  coverage horizon, and the pms_identifier cross-check
- Splits MediaProvider into MediaProvider + HistoryProvider so library data
  and watch data can come from different servers
- watch_event gains percent_complete, disposition, source, and session
  merging; media_item gains partial/abandoned counts and pre_history
- New 'rejection' score component, with weights renormalizing when a
  component is unavailable rather than silently scoring everything lower
- Deployment: image built off-box and pushed to Nox's Portainer, versioned
  tags rather than :latest
- Closes three open questions, opens two smaller ones

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GVbG48GAXfCZatcmX123Ra

.env.example

@@ -13,6 +13,19 @@ PLEX_TIMEOUT_S=30
 PLEX_PAGE_SIZE=500
 PLEX_REQUEST_DELAY_MS=0
 
+# --- Tautulli (primary watch-history source) ---
+# Leave TAUTULLI_BASE_URL empty to disable and fall back to Plex session history.
+TAUTULLI_BASE_URL=http://192.168.1.100:8181
+TAUTULLI_API_KEY=your-tautulli-api-key-here
+TAUTULLI_TIMEOUT_S=30
+TAUTULLI_PAGE_SIZE=1000
+
+# auto | tautulli | plex
+HISTORY_SOURCE=auto
+SESSION_MERGE_WINDOW_H=6
+COMPLETION_THRESHOLD=85
+ABANDON_CEILING=15
+
 # --- Storage ---
 DATABASE_PATH=/data/mediashelf.db
 
@@ -26,5 +39,6 @@ SCAN_LOCK_TIMEOUT_S=7200
 SCORE_STALE_HORIZON_DAYS=730
 SCORE_AGE_HORIZON_DAYS=1095
 SCORE_POPULAR_AT=3
+SCORE_REJECTED_AT=2
 SCORE_GRACE_DAYS=30
 SCORE_RECENT_DAYS=90