Support Jellyfin 12 alongside 10.11

Jellyfin 12 moved to .NET 10 and changed the IUserManager surface the
plugin relies on: Users/UsersIds became GetUsers()/GetUsersIds(),
ChangePassword takes a user id, HasPassword left the provider contract,
and the user cache is gone, so every lookup is a detached copy.

The plugin now multi-targets net9.0 (against 10.11.5) and net10.0
(against 12.0.0). The differences sit behind a JELLYFIN_12 constant in
Compat/UserManagerCompat.cs, whose ChangePasswordAsync also carries the
stored hash back onto the caller's instance: on 12 the UpdateUserAsync
that claims the account would otherwise write the stale null password
back over the one provisioning just set.

Each release ships one package per generation, with the fourth version
segment naming the target (x.y.z.11 and x.y.z.12) so a 12 server picks
the 12 package over the 10.11 one. scripts/package.sh wraps jprm for a
single generation and the workflows call it twice. The builder image
moves to the .NET 10 SDK, which builds both targets; the net9.0 test run
rolls forward onto the .NET 10 runtime.

CA1873 is a .NET 10 analyzer that flags the same log calls CA1848 does;
it is set to Info, as in the upstream Jellyfin 12 tree.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/package.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+#
+# Packages the plugin for one Jellyfin generation with jprm.
+#
+#   scripts/package.sh <10.11|12> <version> [output-dir]
+#
+# The plugin is built once per generation: Jellyfin 10.11 loads a net9.0 assembly and Jellyfin 12 a
+# net10.0 one, and each package's meta.json must carry the matching targetAbi or the server refuses
+# to load it. jprm takes the framework on the command line but reads targetAbi from build.yaml, so
+# this stamps build.yaml for the chosen generation and restores it afterwards.
+#
+# Jellyfin installs the highest manifest version whose targetAbi it satisfies, so when both packages
+# are published from one release the 12 package must carry the higher version number. The release
+# workflow does that by reserving the fourth version segment for the generation (X.Y.Z.11 and
+# X.Y.Z.12).
+set -euo pipefail
+
+target="${1:?usage: $0 <10.11|12> <version> [output-dir]}"
+version="${2:?usage: $0 <10.11|12> <version> [output-dir]}"
+output="${3:-artifacts}"
+
+case "$target" in
+  10.11) framework="net9.0";  target_abi="10.11.0.0" ;;
+  12)    framework="net10.0"; target_abi="12.0.0.0" ;;
+  *) echo "unknown Jellyfin target '$target' (expected 10.11 or 12)" >&2; exit 2 ;;
+esac
+
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$repo_root"
+
+cp build.yaml build.yaml.orig
+trap 'mv build.yaml.orig build.yaml' EXIT
+
+sed -i \
+  -e "s/^version:.*/version: \"${version}\"/" \
+  -e "s/^targetAbi:.*/targetAbi: \"${target_abi}\"/" \
+  -e "s/^framework:.*/framework: \"${framework}\"/" \
+  -e "s/^dotnet_framework:.*/dotnet_framework: \"${framework}\"/" \
+  build.yaml
+
+mkdir -p "$output"
+jprm --verbosity=debug plugin build . \
+  --output "$output" \
+  --version "$version" \
+  --dotnet-framework "$framework"