Implement Watched Together shared viewing accounts

Replaces the plugin template with a working plugin that lets several
users share one viewing account while keeping their individual watched
lists accurate.

Three pieces:

- Auto-creating groups. Logging in as "alice+bob" with any named
  member's own password provisions the shared account and signs you in.
  Verified against 10.11.5: AuthenticateUser offers unmatched usernames
  to every enabled provider and re-queries afterwards, which is the hook
  this relies on. Gated on a real member password so knowing two
  usernames is not enough to create an account.

- Multi-password authentication. IRequiresResolvedUser hands us the
  resolved shared account; each member's live stored hash is checked via
  ICryptoProvider.Verify. Deliberately avoids re-entering
  UserManager.AuthenticateUser, which would trip every member's
  failed-attempt counter whenever a different member's password matched.

- One-way played-state sync. Shared account to members only, filtered to
  PlaybackFinished/TogglePlayed/Import so playback progress ticks are
  ignored. No loop guard needed: member writes carry a non-shared id.

Membership is stored as user IDs rather than re-parsed from the username,
so shared accounts can be renamed freely. The +/name collision resolves
itself because Jellyfin only consults the plugin when no local user
matches the typed name.

Targets Jellyfin 10.11.x / net9.0. Adds Gitea CI (test, build, release),
a builder image, and 34 tests covering the auth and sync rules.

Jellyfin.Plugin.WatchedTogether/Services/WatchedStateSyncService.cs

@@ -0,0 +1,147 @@
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+using MediaBrowser.Controller.Library;
+using MediaBrowser.Model.Entities;
+using Microsoft.Extensions.Hosting;
+using Microsoft.Extensions.Logging;
+
+namespace Jellyfin.Plugin.WatchedTogether.Services;
+
+/// <summary>
+/// Propagates played state from a shared account to each of its members, one way.
+/// </summary>
+public sealed class WatchedStateSyncService : IHostedService, IDisposable
+{
+    private readonly IUserDataManager _userDataManager;
+    private readonly IUserManager _userManager;
+    private readonly IGroupService _groupService;
+    private readonly ILogger<WatchedStateSyncService> _logger;
+    private bool _disposed;
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="WatchedStateSyncService"/> class.
+    /// </summary>
+    /// <param name="userDataManager">The user data manager.</param>
+    /// <param name="userManager">The user manager.</param>
+    /// <param name="groupService">The group service.</param>
+    /// <param name="logger">The logger.</param>
+    public WatchedStateSyncService(
+        IUserDataManager userDataManager,
+        IUserManager userManager,
+        IGroupService groupService,
+        ILogger<WatchedStateSyncService> logger)
+    {
+        _userDataManager = userDataManager;
+        _userManager = userManager;
+        _groupService = groupService;
+        _logger = logger;
+    }
+
+    /// <inheritdoc />
+    public Task StartAsync(CancellationToken cancellationToken)
+    {
+        _userDataManager.UserDataSaved += OnUserDataSaved;
+        _logger.LogInformation("Watched Together sync started");
+        return Task.CompletedTask;
+    }
+
+    /// <inheritdoc />
+    public Task StopAsync(CancellationToken cancellationToken)
+    {
+        _userDataManager.UserDataSaved -= OnUserDataSaved;
+        _logger.LogInformation("Watched Together sync stopped");
+        return Task.CompletedTask;
+    }
+
+    /// <inheritdoc />
+    public void Dispose()
+    {
+        if (_disposed)
+        {
+            return;
+        }
+
+        _userDataManager.UserDataSaved -= OnUserDataSaved;
+        _disposed = true;
+    }
+
+    /// <summary>
+    /// Mirrors a shared account's played state onto its members.
+    /// </summary>
+    /// <remarks>
+    /// No loop guard is needed. Writing to a member raises this event again with that member's id,
+    /// which is not a shared account id, so the handler returns immediately. The
+    /// <c>Played</c> equality check below suppresses redundant writes on top of that.
+    /// </remarks>
+    private void OnUserDataSaved(object? sender, UserDataSaveEventArgs e)
+    {
+        if (e?.UserData is null || e.Item is null)
+        {
+            return;
+        }
+
+        // UserDataSaved fires constantly during playback (progress ticks); only act on the reasons
+        // that actually represent a change in watched state.
+        if (e.SaveReason is not (UserDataSaveReason.PlaybackFinished
+            or UserDataSaveReason.TogglePlayed
+            or UserDataSaveReason.Import))
+        {
+            return;
+        }
+
+        var group = _groupService.GetGroupForSharedUser(e.UserId);
+        if (group is null)
+        {
+            return;
+        }
+
+        var played = e.UserData.Played;
+        if (!played && !group.SyncUnwatched)
+        {
+            return;
+        }
+
+        foreach (var member in _groupService.GetEligibleMembers(group))
+        {
+            try
+            {
+                var data = _userDataManager.GetUserData(member, e.Item);
+                if (data is null || data.Played == played)
+                {
+                    continue;
+                }
+
+                data.Played = played;
+
+                if (group.SyncPlayCount && played && data.PlayCount < 1)
+                {
+                    data.PlayCount = 1;
+                }
+
+                _userDataManager.SaveUserData(
+                    member,
+                    e.Item,
+                    data,
+                    UserDataSaveReason.TogglePlayed,
+                    CancellationToken.None);
+
+                _logger.LogDebug(
+                    "Synced played={Played} for {ItemName} to member {MemberUsername}",
+                    played,
+                    e.Item.Name,
+                    member.Username);
+            }
+#pragma warning disable CA1031 // One member failing must not stop the rest from syncing.
+            catch (Exception ex)
+#pragma warning restore CA1031
+            {
+                _logger.LogError(
+                    ex,
+                    "Failed to sync played state for {ItemName} to member {MemberId}",
+                    e.Item.Name,
+                    member.Id);
+            }
+        }
+    }
+}