Implement Watched Together shared viewing accounts

Replaces the plugin template with a working plugin that lets several
users share one viewing account while keeping their individual watched
lists accurate.

Three pieces:

- Auto-creating groups. Logging in as "alice+bob" with any named
  member's own password provisions the shared account and signs you in.
  Verified against 10.11.5: AuthenticateUser offers unmatched usernames
  to every enabled provider and re-queries afterwards, which is the hook
  this relies on. Gated on a real member password so knowing two
  usernames is not enough to create an account.

- Multi-password authentication. IRequiresResolvedUser hands us the
  resolved shared account; each member's live stored hash is checked via
  ICryptoProvider.Verify. Deliberately avoids re-entering
  UserManager.AuthenticateUser, which would trip every member's
  failed-attempt counter whenever a different member's password matched.

- One-way played-state sync. Shared account to members only, filtered to
  PlaybackFinished/TogglePlayed/Import so playback progress ticks are
  ignored. No loop guard needed: member writes carry a non-shared id.

Membership is stored as user IDs rather than re-parsed from the username,
so shared accounts can be renamed freely. The +/name collision resolves
itself because Jellyfin only consults the plugin when no local user
matches the typed name.

Targets Jellyfin 10.11.x / net9.0. Adds Gitea CI (test, build, release),
a builder image, and 34 tests covering the auth and sync rules.

.gitea/workflows/build.yaml

@@ -0,0 +1,89 @@
+name: '🏗️ Build Plugin'
+
+on:
+  push:
+    branches:
+      - master
+    paths-ignore:
+      - '**/*.md'
+  pull_request:
+    branches:
+      - master
+    paths-ignore:
+      - '**/*.md'
+  workflow_dispatch:
+
+jobs:
+  build:
+    runs-on: linux/amd64
+    container:
+      image: gitea.tourolle.paris/dtourolle/watchedtogether-builder:latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          path: build-${{ github.run_id }}
+
+      - name: Cache NuGet packages
+        uses: actions/cache@v3
+        with:
+          path: ~/.nuget/packages
+          key: nuget-${{ hashFiles('**/Jellyfin.Plugin.WatchedTogether.csproj', '**/Jellyfin.Plugin.WatchedTogether.Tests.csproj') }}
+          restore-keys: nuget-
+
+      - name: Restore dependencies
+        working-directory: build-${{ github.run_id }}
+        run: dotnet restore Jellyfin.Plugin.WatchedTogether.sln
+
+      - name: Compute build version
+        id: version
+        run: |
+          # Date-based version so a side-loaded build is identifiable in Jellyfin.
+          DATE=$(date -u +"%Y%m%d")
+          VERSION="1.0.${DATE}.${{ github.run_number }}"
+          if [ -n "${{ github.event.pull_request.number }}" ]; then
+            LABEL="pr${{ github.event.pull_request.number }}"
+          else
+            LABEL="master"
+          fi
+          echo "version=${VERSION}" >> $GITHUB_OUTPUT
+          echo "label=${LABEL}" >> $GITHUB_OUTPUT
+          echo "Build version: ${VERSION} (${LABEL})"
+
+      - name: Set build version
+        working-directory: build-${{ github.run_id }}
+        run: |
+          sed -i "s/^version:.*/version: \"${{ steps.version.outputs.version }}\"/" build.yaml
+
+      - name: Build solution
+        working-directory: build-${{ github.run_id }}
+        run: dotnet build Jellyfin.Plugin.WatchedTogether.sln --configuration Release --no-restore --no-self-contained /m:1
+
+      - name: Run tests
+        working-directory: build-${{ github.run_id }}
+        run: dotnet test Jellyfin.Plugin.WatchedTogether.sln --no-build --configuration Release --verbosity normal
+
+      - name: Build Jellyfin Plugin
+        id: jprm
+        working-directory: build-${{ github.run_id }}
+        run: |
+          mkdir -p artifacts
+          jprm --verbosity=debug plugin build .
+          ARTIFACT=$(find . -name "*.zip" -type f -print -quit | sed 's|^\./||')
+          LATEST="artifacts/watchedtogether_latest.zip"
+          cp "${ARTIFACT}" "${LATEST}"
+          echo "artifact=${LATEST}" >> $GITHUB_OUTPUT
+          echo "Found artifact: ${ARTIFACT} -> ${LATEST}"
+
+      - name: Upload build artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: watchedtogether-${{ steps.version.outputs.label }}-${{ steps.version.outputs.version }}
+          path: build-${{ github.run_id }}/${{ steps.jprm.outputs.artifact }}
+          retention-days: 30
+          if-no-files-found: error
+
+      - name: Cleanup
+        if: always()
+        run: rm -rf build-${{ github.run_id }}

.gitea/workflows/release.yaml

@@ -0,0 +1,166 @@
+name: '🚀 Release Plugin'
+
+on:
+  push:
+    tags:
+      - 'v*.*.*'
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Version to release (e.g., v1.0.0)'
+        required: true
+        type: string
+
+jobs:
+  build-and-release:
+    runs-on: linux/amd64
+    container:
+      image: gitea.tourolle.paris/dtourolle/watchedtogether-builder:latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          path: release-${{ github.run_id }}
+
+      - name: Get version
+        id: get_version
+        run: |
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            VERSION="${{ github.event.inputs.version }}"
+          else
+            VERSION="${GITHUB_REF#refs/tags/}"
+          fi
+          echo "version=${VERSION}" >> $GITHUB_OUTPUT
+          echo "version_number=${VERSION#v}" >> $GITHUB_OUTPUT
+          echo "Building version: ${VERSION}"
+
+      - name: Update build.yaml with version
+        working-directory: release-${{ github.run_id }}
+        run: |
+          VERSION="${{ steps.get_version.outputs.version_number }}"
+          sed -i "s/^version:.*/version: \"${VERSION}\"/" build.yaml
+          cat build.yaml
+
+      - name: Cache NuGet packages
+        uses: actions/cache@v3
+        with:
+          path: ~/.nuget/packages
+          key: nuget-${{ hashFiles('**/Jellyfin.Plugin.WatchedTogether.csproj', '**/Jellyfin.Plugin.WatchedTogether.Tests.csproj') }}
+          restore-keys: nuget-
+
+      - name: Restore dependencies
+        working-directory: release-${{ github.run_id }}
+        run: dotnet restore Jellyfin.Plugin.WatchedTogether.sln
+
+      - name: Build solution
+        working-directory: release-${{ github.run_id }}
+        run: dotnet build Jellyfin.Plugin.WatchedTogether.sln --configuration Release --no-restore --no-self-contained /m:1
+
+      - name: Run tests
+        working-directory: release-${{ github.run_id }}
+        run: dotnet test Jellyfin.Plugin.WatchedTogether.sln --no-build --configuration Release --verbosity normal
+
+      - name: Build Jellyfin Plugin
+        id: jprm
+        working-directory: release-${{ github.run_id }}
+        run: |
+          mkdir -p artifacts
+          jprm --verbosity=debug plugin build ./
+          ARTIFACT=$(find . -name "*.zip" -type f -print -quit | sed 's|^\./||')
+          ARTIFACT_NAME=$(basename "${ARTIFACT}")
+          echo "artifact=${ARTIFACT}" >> $GITHUB_OUTPUT
+          echo "artifact_name=${ARTIFACT_NAME}" >> $GITHUB_OUTPUT
+          echo "Found artifact: ${ARTIFACT}"
+
+      - name: Calculate checksum
+        id: checksum
+        working-directory: release-${{ github.run_id }}
+        run: |
+          CHECKSUM=$(md5sum "${{ steps.jprm.outputs.artifact }}" | awk '{print $1}')
+          echo "checksum=${CHECKSUM}" >> $GITHUB_OUTPUT
+          echo "Checksum: ${CHECKSUM}"
+
+      - name: Create Release
+        working-directory: release-${{ github.run_id }}
+        env:
+          GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          REPO_OWNER="${{ github.repository_owner }}"
+          REPO_NAME="${{ github.event.repository.name }}"
+          GITEA_URL="${{ github.server_url }}"
+          VERSION="${{ steps.get_version.outputs.version }}"
+
+          RESPONSE=$(curl -s -w "\n%{http_code}" -X POST \
+            -H "Authorization: token ${GITEA_TOKEN}" \
+            -H "Content-Type: application/json" \
+            "${GITEA_URL}/api/v1/repos/${REPO_OWNER}/${REPO_NAME}/releases" \
+            -d "$(jq -n --arg tag "$VERSION" --arg name "Release $VERSION" --arg body "Watched Together Jellyfin plugin. See attached files for installation." '{tag_name: $tag, name: $name, body: $body, draft: false, prerelease: false}')")
+
+          HTTP_CODE=$(echo "$RESPONSE" | tail -n1)
+          BODY=$(echo "$RESPONSE" | sed '$d')
+
+          if [ "$HTTP_CODE" -ge 200 ] && [ "$HTTP_CODE" -lt 300 ]; then
+            RELEASE_ID=$(echo "$BODY" | jq -r '.id')
+            echo "Created release with ID: ${RELEASE_ID}"
+          else
+            echo "Failed to create release. HTTP ${HTTP_CODE}"
+            echo "$BODY"
+            exit 1
+          fi
+
+          echo "Uploading plugin artifact..."
+          curl -f -X POST \
+            -H "Authorization: token ${GITEA_TOKEN}" \
+            -H "Content-Type: application/zip" \
+            --data-binary "@${{ steps.jprm.outputs.artifact }}" \
+            "${GITEA_URL}/api/v1/repos/${REPO_OWNER}/${REPO_NAME}/releases/${RELEASE_ID}/assets?name=${{ steps.jprm.outputs.artifact_name }}"
+
+          echo "Uploading build.yaml..."
+          curl -f -X POST \
+            -H "Authorization: token ${GITEA_TOKEN}" \
+            -H "Content-Type: application/x-yaml" \
+            --data-binary "@build.yaml" \
+            "${GITEA_URL}/api/v1/repos/${REPO_OWNER}/${REPO_NAME}/releases/${RELEASE_ID}/assets?name=build.yaml"
+
+          echo "✅ Release created successfully!"
+
+      - name: Update manifest.json
+        working-directory: release-${{ github.run_id }}
+        env:
+          GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          REPO_OWNER="${{ github.repository_owner }}"
+          REPO_NAME="${{ github.event.repository.name }}"
+          GITEA_URL="${{ github.server_url }}"
+          VERSION="${{ steps.get_version.outputs.version_number }}"
+          CHECKSUM="${{ steps.checksum.outputs.checksum }}"
+          ARTIFACT_NAME="${{ steps.jprm.outputs.artifact_name }}"
+          TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
+          DOWNLOAD_URL="${GITEA_URL}/${REPO_OWNER}/${REPO_NAME}/releases/download/${{ steps.get_version.outputs.version }}/${ARTIFACT_NAME}"
+
+          git config user.name "Gitea Actions"
+          git config user.email "actions@gitea.tourolle.paris"
+          git fetch origin master
+          git checkout master
+
+          NEW_VERSION=$(cat <<EOF
+          {
+            "version": "${VERSION}",
+            "changelog": "Release ${VERSION}",
+            "targetAbi": "10.11.0.0",
+            "sourceUrl": "${DOWNLOAD_URL}",
+            "checksum": "${CHECKSUM}",
+            "timestamp": "${TIMESTAMP}"
+          }
+          EOF
+          )
+
+          jq --argjson newver "${NEW_VERSION}" '.[0].versions = [$newver] + .[0].versions' manifest.json > manifest.tmp && mv manifest.tmp manifest.json
+          git add manifest.json
+          git commit -m "Update manifest.json for version ${VERSION}"
+          git push origin master
+
+      - name: Cleanup
+        if: always()
+        run: rm -rf release-${{ github.run_id }}

.gitea/workflows/test.yaml

@@ -0,0 +1,59 @@
+name: '🧪 Test Plugin'
+
+on:
+  push:
+    branches:
+      - master
+      - develop
+    paths-ignore:
+      - '**/*.md'
+  pull_request:
+    branches:
+      - master
+      - develop
+    paths-ignore:
+      - '**/*.md'
+  workflow_dispatch:
+
+jobs:
+  test:
+    runs-on: linux/amd64
+    container:
+      image: gitea.tourolle.paris/dtourolle/watchedtogether-builder:latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          path: test-${{ github.run_id }}
+
+      - name: Cache NuGet packages
+        uses: actions/cache@v3
+        with:
+          path: ~/.nuget/packages
+          key: nuget-${{ hashFiles('**/Jellyfin.Plugin.WatchedTogether.csproj', '**/Jellyfin.Plugin.WatchedTogether.Tests.csproj') }}
+          restore-keys: nuget-
+
+      - name: Restore dependencies
+        working-directory: test-${{ github.run_id }}
+        run: dotnet restore Jellyfin.Plugin.WatchedTogether.sln
+
+      - name: Build solution
+        working-directory: test-${{ github.run_id }}
+        run: dotnet build Jellyfin.Plugin.WatchedTogether.sln --configuration Debug --no-restore --no-self-contained /m:1
+
+      - name: Run tests
+        working-directory: test-${{ github.run_id }}
+        run: dotnet test Jellyfin.Plugin.WatchedTogether.sln --no-build --configuration Debug --verbosity normal --logger "trx;LogFileName=test-results.trx"
+
+      - name: Upload test results
+        if: always()
+        uses: actions/upload-artifact@v3
+        with:
+          name: test-results
+          path: test-${{ github.run_id }}/**/test-results.trx
+          retention-days: 7
+
+      - name: Cleanup
+        if: always()
+        run: rm -rf test-${{ github.run_id }}