meta-core claims model: pin meta-core 2.0.1, meta-read 1.4.1, meta-watch 1.1.0, meta-search 1.3.2, meta-share 2.7.0, gateway 1.1.1, meta-sort 1.1.1, plugins 1.1.0; signing keys + db-cache backup exclude

Apps/MetaPluginSubtitleExtractor/docker-compose.yml

@@ -33,7 +33,7 @@ services:
   # consumer on the box can reach it by name. Default queue: background.
   # ---------------------------------------------------------------------------
   metapluginsubtitleextractor-plugin:
-    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-subtitle-extractor:1.0.4
+    image: ipcr-watch.nsl.sh/ipns/metadec.eth/metadec.eth/metamesh-plugin-subtitle-extractor:1.1.0
     cpu_shares: 30
     container_name: metapluginsubtitleextractor-plugin
     # Hard RAM cap, swap disabled (memswap_limit == mem_limit) → OOM
@@ -53,10 +53,16 @@ services:
       # nothing. Every record then fails MetaWatch's poster gate.
       WEBDAV_URL: "http://metacore-app:9000/webdav"
       TZ: "$TZ"
+      # meta-core claims model (v2.0.0): this plugin signs its own claims.
+      # Key generated on first boot if missing; lives in the backed-up keys/ dir.
+      METAMESH_SIGNING_KEY_FILE: "/keys/metapluginsubtitleextractor-plugin.key"
     volumes:
       # Plugin cache. Persisted so a recreate does not redo work that is
       # expensive to redo; safe to delete, it rebuilds.
       - ${DATA_ROOT:-/DATA}/AppData/metapluginsubtitleextractor/cache:/cache:rw
+      # Signing key (METAMESH_SIGNING_KEY_FILE). Config, not cache: it is the
+      # plugin's identity on every claim, so it MUST be backed up.
+      - ${DATA_ROOT:-/DATA}/AppData/metapluginsubtitleextractor/keys:/keys:rw
     networks:
       - pcs
 networks:
@@ -145,3 +151,6 @@ x-compose-app:
     - path: /DATA/AppData/metapluginsubtitleextractor/cache
       user: $PUID
       group: $PGID
+    - path: /DATA/AppData/metapluginsubtitleextractor/keys
+      user: $PUID
+      group: $PGID