Implement Watched Together shared viewing accounts

Replaces the plugin template with a working plugin that lets several
users share one viewing account while keeping their individual watched
lists accurate.

Three pieces:

- Auto-creating groups. Logging in as "alice+bob" with any named
  member's own password provisions the shared account and signs you in.
  Verified against 10.11.5: AuthenticateUser offers unmatched usernames
  to every enabled provider and re-queries afterwards, which is the hook
  this relies on. Gated on a real member password so knowing two
  usernames is not enough to create an account.

- Multi-password authentication. IRequiresResolvedUser hands us the
  resolved shared account; each member's live stored hash is checked via
  ICryptoProvider.Verify. Deliberately avoids re-entering
  UserManager.AuthenticateUser, which would trip every member's
  failed-attempt counter whenever a different member's password matched.

- One-way played-state sync. Shared account to members only, filtered to
  PlaybackFinished/TogglePlayed/Import so playback progress ticks are
  ignored. No loop guard needed: member writes carry a non-shared id.

Membership is stored as user IDs rather than re-parsed from the username,
so shared accounts can be renamed freely. The +/name collision resolves
itself because Jellyfin only consults the plugin when no local user
matches the typed name.

Targets Jellyfin 10.11.x / net9.0. Adds Gitea CI (test, build, release),
a builder image, and 34 tests covering the auth and sync rules.

Jellyfin.Plugin.WatchedTogether/Configuration/PluginConfiguration.cs

@@ -0,0 +1,47 @@
+using System.Collections.Generic;
+using System.Diagnostics.CodeAnalysis;
+using MediaBrowser.Model.Plugins;
+
+namespace Jellyfin.Plugin.WatchedTogether.Configuration;
+
+/// <summary>
+/// Plugin configuration. Holds the authoritative record of which members belong to which
+/// shared account.
+/// </summary>
+public class PluginConfiguration : BasePluginConfiguration
+{
+    /// <summary>
+    /// Gets or sets the configured shared-account groups.
+    /// </summary>
+    [SuppressMessage("Usage", "CA2227:Collection properties should be read only", Justification = "Plugin configuration is round-tripped by the XML serializer, which requires a settable List<T>.")]
+    [SuppressMessage("Design", "CA1002:Do not expose generic lists", Justification = "Plugin configuration is round-tripped by the XML serializer, which requires a settable List<T>.")]
+    public List<SharedGroup> Groups { get; set; } = new();
+
+    /// <summary>
+    /// Gets or sets the separator used to join member names into a shared account name. Also the
+    /// separator split at login when <see cref="EnableDynamicGroups"/> is on.
+    /// </summary>
+    public string NameSeparator { get; set; } = "+";
+
+    /// <summary>
+    /// Gets or sets a value indicating whether typing an unrecognised name like "alice+bob" at the
+    /// login screen creates the shared account on the spot.
+    /// </summary>
+    /// <remarks>
+    /// The account is only created if every named part is an existing, enabled, non-shared user
+    /// <em>and</em> the submitted password belongs to one of them. A real account whose name
+    /// happens to contain the separator always takes precedence, because Jellyfin only consults
+    /// this plugin once no local user matches the typed name.
+    /// </remarks>
+    public bool EnableDynamicGroups { get; set; } = true;
+
+    /// <summary>
+    /// Gets or sets a value indicating whether accounts created on demand may access all libraries.
+    /// </summary>
+    /// <remarks>
+    /// Leaving this on means a dynamically created account sees every library, regardless of what
+    /// its members can each reach individually. Turn it off to have such accounts start with no
+    /// library access until an administrator grants it.
+    /// </remarks>
+    public bool DynamicGroupsEnableAllFolders { get; set; } = true;
+}