fix(auth): use the authentication spellings Jellyfin 12.0 leaves enabled

X-Emby-Authorization at the remaining request builders, and api_key= in the
player-facing URLs, become Authorization and ApiKey.

Jellyfin 12.0 disables X-Emby-Authorization, X-Emby-Token, X-MediaBrowser-Token,
the Emby scheme and the api_key query parameter by default — and a migration
(DisableLegacyAuthorization) turns them off on servers upgraded from 10.11 as
well, so this is not confined to fresh installs. A client using them stops
working against an upgraded server rather than degrading.

Verified at source level rather than inferred: AuthorizationContext.cs is
byte-identical between v10.11.5 and v12.0 apart from whitespace. The only change
is the default of the gate that guards the legacy spellings. Authorization with
the MediaBrowser scheme, and ApiKey as a query parameter, are ungated in both
trees — and the server itself emits ApiKey in both (StreamInfo.cs). So one
spelling is correct everywhere and no capability flag is involved.

Also adds ServerCompatibility to ServerInfo: an opaque verdict the frontend
renders without ever comparing a version number, with three states rather than a
boolean. A server newer than this build is usable, not refused; an unreadable
version string is not grounds for refusal either. Only a server below the floor
is refused.

TRACES: UR-085 | DR-286, DR-287

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src-tauri/src/repository/device_profile.rs

@@ -434,7 +434,7 @@ mod tests {
     #[test]
     fn an_unconditional_burn_in_flag_is_stripped_whatever_its_casing() {
         let url = without_server_chosen_subtitle(
-            "/videos/abc/master.m3u8?api_key=k&alwaysBurnInSubtitleWhenTranscoding=true\
+            "/videos/abc/master.m3u8?ApiKey=k&alwaysBurnInSubtitleWhenTranscoding=true\
              &subtitlestreamindex=3&SubtitleCodec=ass",
         );
 
@@ -442,7 +442,7 @@ mod tests {
         assert!(!url.to_lowercase().contains("subtitlecodec"), "{url}");
         assert!(!url.contains("subtitlestreamindex=3"), "{url}");
         assert!(url.contains("SubtitleStreamIndex=-1"), "{url}");
-        assert!(url.contains("api_key=k"), "{url}");
+        assert!(url.contains("ApiKey=k"), "{url}");
     }
 
     /// A URL the server built without any subtitle in it still has to *say* so:
@@ -451,10 +451,10 @@ mod tests {
     /// TRACES: UR-020, UR-004 | DR-176 | UT-168
     #[test]
     fn a_url_with_no_subtitle_params_is_still_made_to_ask_for_none() {
-        let url = without_server_chosen_subtitle("/videos/abc/master.m3u8?api_key=k");
+        let url = without_server_chosen_subtitle("/videos/abc/master.m3u8?ApiKey=k");
         assert_eq!(
             url,
-            "/videos/abc/master.m3u8?api_key=k&SubtitleStreamIndex=-1"
+            "/videos/abc/master.m3u8?ApiKey=k&SubtitleStreamIndex=-1"
         );
 
         // A bare URL is rare but must not come out malformed.