feat(login): show the backend's server-version verdict, and drop a dead route builder

Two frontend halves of the version-compatibility work.

The login flow now renders ServerCompatibility. A server below the floor blocks
with a message naming the minimum; a server newer than this build gets a
non-blocking note and proceeds; an unreadable version says nothing at all,
because refusing — or even warning — on a version string we could not parse would
punish the user for a limitation of ours.

The frontend never receives a version number to reason about, only the opaque
verdict, for the same reason it never receives an item-type list. Rust decides
whether the server is usable; the frontend decides only how that reads.

Separately, imageCache.getCachedImageUrl is deleted. It built
${serverUrl}/Items/${itemId}/Images/${imageType} in Svelte — a Jellyfin route in
the presentation layer, which is domain logic by this project's own litmus test
(would it change if Jellyfin changed its API?). check:boundary does not catch it:
the tripwire flags item-type array literals, not route strings.

It was also entirely unused. Nothing outside its own file and test ever called
it; the live path is CachedImage.svelte -> commands.imageGetUrl -> Rust, which
was already correct. So the leak was in dead code and the fix is a deletion
rather than a migration.

One consequence left deliberately unacted: that function was the last
convertFileSrc caller, so the asset-protocol grant narrowed to
$APPDATA/thumbnails/** under DR-198 now has no caller at all. Dropping a
capability grant is a security change that deserves its own commit and its own
testing on Android, not a side effect of deleting dead code. Noted in the file.

TRACES: UR-012, UR-085 | DR-285, DR-286

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/routes/login/+page.svelte

@@ -1,6 +1,7 @@
 <script lang="ts">
   import { goto } from "$app/navigation";
   import { auth, isAuthenticated, isLoading, authError } from "$lib/stores/auth";
+  import { compatibilityNotice } from "$lib/utils/serverCompatibility";
 
   let step = $state<"server" | "login">("server");
   let serverUrl = $state("");
@@ -11,6 +12,8 @@
   let connecting = $state(false);
   let loggingIn = $state(false);
   let localError = $state<string | null>(null);
+  /// Non-blocking note about the server version (e.g. newer than this build).
+  let serverNotice = $state<string | null>(null);
 
   // Redirect to library if already authenticated
   $effect(() => {
@@ -36,6 +39,16 @@
 
     try {
       const info = await auth.connectToServer(serverUrl);
+
+      // The backend decided whether this server's version is usable; we only
+      // render its verdict. TRACES: UR-085 | DR-286
+      const notice = compatibilityNotice(info.compatibility, info.version);
+      if (notice?.blocking) {
+        localError = notice.message;
+        return;
+      }
+      serverNotice = notice?.message ?? null;
+
       serverName = info.name;
       serverUrl = info.normalizedUrl; // Use normalized URL with https://
       step = "login";
@@ -224,6 +237,14 @@
           </div>
         </div>
 
+        {#if serverNotice}
+          <div
+            class="p-3 bg-amber-900/40 border border-amber-700 rounded-lg text-amber-200 text-sm"
+          >
+            {serverNotice}
+          </div>
+        {/if}
+
         {#if localError || $authError}
           <div class="p-3 bg-red-900/50 border border-red-700 rounded-lg text-red-200 text-sm">
             {localError || $authError}