Inherit parental restrictions on shared accounts, with a chosen rating cap

A shared account previously inherited its members' library access but
none of their content restrictions, so a child could log into "alice+kid"
with their own password and get around their own rating cap.

The shared account now gets the strictest member's parental rating,
unrated-item block, blocked tags and allowed tags, recomputed at
creation, on membership change and at startup. An admin can raise the
rating cap on a slider between the strictest and the loosest member;
unrated and tag rules stay strictest-wins.

What makes raising the cap safe is the unlock rule: after a member's
password matches, both users' live policies are compared and the login
is refused if the account is looser than the member on any field. So
raising the cap above the child's rating means the child's password no
longer opens the account, while the parent's still does. The same rule
bounds the slider - past the loosest member nobody could unlock the
account - so a chosen cap is clamped back into range whenever applied.

Allowed tags need care: Jellyfin reads an empty list as "no whitelist",
so an empty intersection of members' whitelists is written as a sentinel
tag no item carries. Access schedules and channels are not inherited yet.

The shared account is never an administrator. Groups created at the
login screen always inherit and are restricted before the first session
exists. The dashboard shows each member's cap, who a chosen cap shuts
out, and the restrictions in effect, and gains a per-group edit form for
the sync options.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Jellyfin.Plugin.WatchedTogether/Auth/SharedAccountAuthenticationProvider.cs

@@ -24,12 +24,20 @@ namespace Jellyfin.Plugin.WatchedTogether.Auth;
 /// matched, eventually locking out members who did nothing wrong. Reading the live hash also means
 /// member password changes take effect immediately, with no second copy of any credential stored.
 /// </para>
+/// <para>
+/// A matching password is not the whole story: the member may only unlock an account that is at
+/// least as restricted as they are. That is checked here against both users' <em>live</em>
+/// policies, so it holds even when the shared account's stored policy has drifted from its
+/// members', and it is what makes choosing a cap safe - the child's password stops opening an
+/// account the parent raised above the child's rating.
+/// </para>
 /// </remarks>
 public class SharedAccountAuthenticationProvider : IAuthenticationProvider, IRequiresResolvedUser
 {
     private readonly ICryptoProvider _cryptoProvider;
     private readonly Lazy<Services.IGroupService> _groupService;
     private readonly Lazy<Services.IDynamicGroupService> _dynamicGroupService;
+    private readonly Lazy<Services.IRestrictionService> _restrictionService;
     private readonly ILogger<SharedAccountAuthenticationProvider> _logger;
 
     /// <summary>
@@ -38,6 +46,7 @@ public class SharedAccountAuthenticationProvider : IAuthenticationProvider, IReq
     /// <param name="cryptoProvider">The crypto provider used to verify stored password hashes.</param>
     /// <param name="groupService">A deferred handle to the group service.</param>
     /// <param name="dynamicGroupService">A deferred handle to the on-demand group creation service.</param>
+    /// <param name="restrictionService">A deferred handle to the content restriction service.</param>
     /// <param name="logger">The logger.</param>
     /// <remarks>
     /// The group services are taken as <see cref="Lazy{T}"/> to break a container-level cycle.
@@ -50,11 +59,13 @@ public class SharedAccountAuthenticationProvider : IAuthenticationProvider, IReq
         ICryptoProvider cryptoProvider,
         Lazy<Services.IGroupService> groupService,
         Lazy<Services.IDynamicGroupService> dynamicGroupService,
+        Lazy<Services.IRestrictionService> restrictionService,
         ILogger<SharedAccountAuthenticationProvider> logger)
     {
         _cryptoProvider = cryptoProvider;
         _groupService = groupService;
         _dynamicGroupService = dynamicGroupService;
+        _restrictionService = restrictionService;
         _logger = logger;
     }
 
@@ -119,6 +130,17 @@ public class SharedAccountAuthenticationProvider : IAuthenticationProvider, IReq
                 continue;
             }
 
+            // Information, not Warning: a child trying their password on the family account after
+            // the parent raised its cap is expected, not an incident.
+            if (!_restrictionService.Value.IsAtLeastAsStrict(resolvedUser, member))
+            {
+                _logger.LogInformation(
+                    "Rejected login for {Username} by member {MemberUsername}: the shared account is less restricted than the member",
+                    resolvedUser.Username,
+                    member.Username);
+                throw new AuthenticationException("Invalid username or password.");
+            }
+
             _logger.LogInformation(
                 "Shared account {SharedUsername} unlocked by member {MemberUsername}",
                 resolvedUser.Username,