Implement Watched Together shared viewing accounts

Replaces the plugin template with a working plugin that lets several
users share one viewing account while keeping their individual watched
lists accurate.

Three pieces:

- Auto-creating groups. Logging in as "alice+bob" with any named
  member's own password provisions the shared account and signs you in.
  Verified against 10.11.5: AuthenticateUser offers unmatched usernames
  to every enabled provider and re-queries afterwards, which is the hook
  this relies on. Gated on a real member password so knowing two
  usernames is not enough to create an account.

- Multi-password authentication. IRequiresResolvedUser hands us the
  resolved shared account; each member's live stored hash is checked via
  ICryptoProvider.Verify. Deliberately avoids re-entering
  UserManager.AuthenticateUser, which would trip every member's
  failed-attempt counter whenever a different member's password matched.

- One-way played-state sync. Shared account to members only, filtered to
  PlaybackFinished/TogglePlayed/Import so playback progress ticks are
  ignored. No loop guard needed: member writes carry a non-shared id.

Membership is stored as user IDs rather than re-parsed from the username,
so shared accounts can be renamed freely. The +/name collision resolves
itself because Jellyfin only consults the plugin when no local user
matches the typed name.

Targets Jellyfin 10.11.x / net9.0. Adds Gitea CI (test, build, release),
a builder image, and 34 tests covering the auth and sync rules.

Jellyfin.Plugin.WatchedTogether.Tests/DynamicGroupTests.cs

@@ -0,0 +1,237 @@
+using System;
+using System.Collections.Generic;
+using System.Threading.Tasks;
+using Jellyfin.Data;
+using Jellyfin.Database.Implementations.Entities;
+using Jellyfin.Database.Implementations.Enums;
+using Jellyfin.Plugin.WatchedTogether.Configuration;
+using Jellyfin.Plugin.WatchedTogether.Services;
+using MediaBrowser.Controller.Library;
+using Microsoft.Extensions.Logging.Abstractions;
+using Moq;
+using Xunit;
+
+namespace Jellyfin.Plugin.WatchedTogether.Tests;
+
+/// <summary>
+/// Covers creating a shared account on the fly from a name typed at the login screen.
+/// </summary>
+/// <remarks>
+/// These tests drive <see cref="DynamicGroupService"/> through a stubbed user manager. They rely on
+/// <see cref="Plugin.Instance"/> configuration, which is set up per test via
+/// <see cref="PluginTestContext"/>.
+/// </remarks>
+[Collection(nameof(PluginTestContext))]
+public class DynamicGroupTests
+{
+    private const string AliceHash = "$PBKDF2-SHA512$iterations=210000$A1A1A1A1$AAAAAAAABBBBBBBB";
+    private const string BobHash = "$PBKDF2-SHA512$iterations=210000$B2B2B2B2$CCCCCCCCDDDDDDDD";
+
+    private static User MakeUser(string name, string? password = null, bool disabled = false)
+    {
+        var user = new User(name, "Prov", "ResetProv");
+        if (password is not null)
+        {
+            user.Password = password;
+        }
+
+        if (disabled)
+        {
+            user.SetPermission(PermissionKind.IsDisabled, true);
+        }
+
+        return user;
+    }
+
+    private sealed record Harness(
+        DynamicGroupService Service,
+        Mock<IProvisioningService> Provisioning);
+
+    private static Harness MakeService(
+        IReadOnlyList<User> knownUsers,
+        params (string Hash, string Password)[] validPairs)
+    {
+        var userManager = new Mock<IUserManager>();
+
+        userManager.Setup(m => m.GetUserByName(It.IsAny<string>()))
+            .Returns((string n) =>
+            {
+                foreach (var u in knownUsers)
+                {
+                    if (string.Equals(u.Username, n, StringComparison.OrdinalIgnoreCase))
+                    {
+                        return u;
+                    }
+                }
+
+                return null!;
+            });
+
+        var provisioning = new Mock<IProvisioningService>();
+        var createdShared = MakeUser("created-shared");
+
+        provisioning.Setup(p => p.CreateGroupAsync(
+                It.IsAny<IReadOnlyList<Guid>>(),
+                It.IsAny<string?>(),
+                It.IsAny<bool>(),
+                It.IsAny<IReadOnlyList<Guid>?>()))
+            .ReturnsAsync((IReadOnlyList<Guid> ids, string? name, bool _, IReadOnlyList<Guid>? _) =>
+                new SharedGroup { SharedUserId = createdShared.Id, MemberUserIds = [.. ids] });
+
+        userManager.Setup(m => m.GetUserById(createdShared.Id)).Returns(createdShared);
+
+        var service = new DynamicGroupService(
+            userManager.Object,
+            provisioning.Object,
+            new StubCryptoProvider(validPairs),
+            NullLogger<DynamicGroupService>.Instance);
+
+        return new Harness(service, provisioning);
+    }
+
+    [Fact]
+    public async Task TypingTwoMemberNames_WithAMemberPassword_CreatesTheAccount()
+    {
+        using var ctx = PluginTestContext.Create();
+        var alice = MakeUser("alice", AliceHash);
+        var bob = MakeUser("bob", BobHash);
+        var h = MakeService([alice, bob], (AliceHash, "alice-pw"));
+
+        var result = await h.Service.TryCreateFromLoginAsync("alice+bob", "alice-pw");
+
+        Assert.NotNull(result);
+        h.Provisioning.Verify(
+            p => p.CreateGroupAsync(
+                It.Is<IReadOnlyList<Guid>>(ids => ids.Count == 2),
+                "alice+bob",
+                It.IsAny<bool>(),
+                It.IsAny<IReadOnlyList<Guid>?>()),
+            Times.Once);
+    }
+
+    [Fact]
+    public async Task AnyNamedMembersPassword_Works()
+    {
+        using var ctx = PluginTestContext.Create();
+        var alice = MakeUser("alice", AliceHash);
+        var bob = MakeUser("bob", BobHash);
+        var h = MakeService([alice, bob], (BobHash, "bob-pw"));
+
+        Assert.NotNull(await h.Service.TryCreateFromLoginAsync("alice+bob", "bob-pw"));
+    }
+
+    [Fact]
+    public async Task WithoutAMatchingPassword_NothingIsCreated()
+    {
+        // Otherwise anyone who knows two usernames could conjure a shared account into existence.
+        using var ctx = PluginTestContext.Create();
+        var alice = MakeUser("alice", AliceHash);
+        var bob = MakeUser("bob", BobHash);
+        var h = MakeService([alice, bob], (AliceHash, "alice-pw"));
+
+        Assert.Null(await h.Service.TryCreateFromLoginAsync("alice+bob", "guessing"));
+        h.Provisioning.VerifyNoOtherCalls();
+    }
+
+    [Fact]
+    public async Task AnUnknownNamePart_IsRejected()
+    {
+        using var ctx = PluginTestContext.Create();
+        var alice = MakeUser("alice", AliceHash);
+        var h = MakeService([alice], (AliceHash, "alice-pw"));
+
+        Assert.Null(await h.Service.TryCreateFromLoginAsync("alice+nobody", "alice-pw"));
+        h.Provisioning.VerifyNoOtherCalls();
+    }
+
+    [Fact]
+    public async Task ADisabledMember_IsRejected()
+    {
+        using var ctx = PluginTestContext.Create();
+        var alice = MakeUser("alice", AliceHash);
+        var bob = MakeUser("bob", BobHash, disabled: true);
+        var h = MakeService([alice, bob], (AliceHash, "alice-pw"));
+
+        Assert.Null(await h.Service.TryCreateFromLoginAsync("alice+bob", "alice-pw"));
+    }
+
+    [Fact]
+    public async Task ASingleName_IsNotAGroup()
+    {
+        using var ctx = PluginTestContext.Create();
+        var alice = MakeUser("alice", AliceHash);
+        var h = MakeService([alice], (AliceHash, "alice-pw"));
+
+        Assert.Null(await h.Service.TryCreateFromLoginAsync("alice", "alice-pw"));
+    }
+
+    [Fact]
+    public async Task TheSameMemberTwice_IsRejected()
+    {
+        using var ctx = PluginTestContext.Create();
+        var alice = MakeUser("alice", AliceHash);
+        var h = MakeService([alice], (AliceHash, "alice-pw"));
+
+        Assert.Null(await h.Service.TryCreateFromLoginAsync("alice+alice", "alice-pw"));
+    }
+
+    [Fact]
+    public async Task AnExistingSharedAccountNamedPart_IsRejected()
+    {
+        // Shared accounts must not nest inside other shared accounts.
+        using var ctx = PluginTestContext.Create();
+        var alice = MakeUser("alice", AliceHash);
+        var existingShared = MakeUser("shared", BobHash);
+        ctx.Configuration.Groups.Add(new SharedGroup { SharedUserId = existingShared.Id });
+
+        var h = MakeService([alice, existingShared], (AliceHash, "alice-pw"));
+
+        Assert.Null(await h.Service.TryCreateFromLoginAsync("alice+shared", "alice-pw"));
+    }
+
+    [Fact]
+    public async Task WhenDisabledInConfiguration_NothingIsCreated()
+    {
+        using var ctx = PluginTestContext.Create();
+        ctx.Configuration.EnableDynamicGroups = false;
+
+        var alice = MakeUser("alice", AliceHash);
+        var bob = MakeUser("bob", BobHash);
+        var h = MakeService([alice, bob], (AliceHash, "alice-pw"));
+
+        Assert.Null(await h.Service.TryCreateFromLoginAsync("alice+bob", "alice-pw"));
+    }
+
+    [Fact]
+    public async Task AConfiguredSeparator_IsHonoured()
+    {
+        using var ctx = PluginTestContext.Create();
+        ctx.Configuration.NameSeparator = "_";
+
+        var alice = MakeUser("alice", AliceHash);
+        var bob = MakeUser("bob", BobHash);
+        var h = MakeService([alice, bob], (AliceHash, "alice-pw"));
+
+        Assert.NotNull(await h.Service.TryCreateFromLoginAsync("alice_bob", "alice-pw"));
+        Assert.Null(await h.Service.TryCreateFromLoginAsync("alice+bob", "alice-pw"));
+    }
+
+    [Fact]
+    public async Task ThreeOrMoreMembers_AreSupported()
+    {
+        using var ctx = PluginTestContext.Create();
+        var alice = MakeUser("alice", AliceHash);
+        var bob = MakeUser("bob", BobHash);
+        var carol = MakeUser("carol", BobHash);
+        var h = MakeService([alice, bob, carol], (AliceHash, "alice-pw"));
+
+        Assert.NotNull(await h.Service.TryCreateFromLoginAsync("alice+bob+carol", "alice-pw"));
+        h.Provisioning.Verify(
+            p => p.CreateGroupAsync(
+                It.Is<IReadOnlyList<Guid>>(ids => ids.Count == 3),
+                It.IsAny<string?>(),
+                It.IsAny<bool>(),
+                It.IsAny<IReadOnlyList<Guid>?>()),
+            Times.Once);
+    }
+}