fix: resolve Jellyfin usernames to internal Id and harden qBittorrent login

Jellyfin: get_user_id() returned the configured user_id verbatim, so a
username like "admin" hit /Users/admin/Views and got HTTP 400 ("The value
'admin' is not valid."). The index worker already had username->Id
resolution, but the live API paths (dashboard counts, media query) did not.
Route all user-scoped paths through the new JellyfinClient.resolve_user_id()
(exact Id match -> Name match -> first user), cached per service/credentials
in get_user_id() so repeated requests don't re-list users. The worker is
simplified to call the same method.

qBittorrent: _login() raised "qBittorrent login failed: " (empty) on a 200
with an empty body, which happens when base_url doesn't reach the qBittorrent
login handler (wrong URL/path or a reverse proxy misroute) — not a credentials
issue. Now accepts the SID cookie as a success signal (reverse proxies that
mangle the body), returns a clear "invalid username or password" for "Fails.",
and surfaces a diagnostic error (HTTP status + body + base_url/proxy hint) for
any other/empty body.

Tests: new tests/test_jellyfin_client.py (5) + 3 qBittorrent login tests.
Full backend suite (384) passes; ruff clean.

backend/tests/test_jellyfin_client.py

@@ -0,0 +1,53 @@
+"""Unit tests for JellyfinClient user-id resolution.
+
+Jellyfin's ``/Users/{id}/...`` endpoints require the internal user Id (a hash),
+not the username. The service ``user_id`` config field accepts either form, so
+``resolve_user_id`` must turn a username like ``'admin'`` into the real Id before
+any user-scoped call. See clients/jellyfin.py.
+"""
+
+from __future__ import annotations
+
+import unittest
+from unittest.mock import patch
+
+from media_library_viewer_api.clients.jellyfin import JellyfinClient
+
+
+class ResolveUserIdTests(unittest.TestCase):
+    def _client(self) -> JellyfinClient:
+        return JellyfinClient("https://jf.example.com", "api-key")
+
+    def test_returns_identifier_when_it_matches_an_internal_id(self) -> None:
+        users = [{"Id": "a1b2", "Name": "admin"}, {"Id": "c3d4", "Name": "friend"}]
+        with patch.object(JellyfinClient, "users", return_value=users):
+            self.assertEqual(self._client().resolve_user_id("c3d4"), "c3d4")
+
+    def test_resolves_username_to_internal_id(self) -> None:
+        """Regression: a configured username 'admin' must resolve to the internal Id.
+
+        Hitting /Users/admin/Views directly returns HTTP 400
+        ('The value 'admin' is not valid.'), so the username form must be resolved.
+        """
+        users = [{"Id": "a1b2c3internal", "Name": "admin"}, {"Id": "zzz", "Name": "other"}]
+        with patch.object(JellyfinClient, "users", return_value=users):
+            self.assertEqual(self._client().resolve_user_id("admin"), "a1b2c3internal")
+
+    def test_falls_back_to_first_user_when_identifier_unknown(self) -> None:
+        users = [{"Id": "first", "Name": "admin"}, {"Id": "second", "Name": "x"}]
+        with patch.object(JellyfinClient, "users", return_value=users):
+            self.assertEqual(self._client().resolve_user_id("nobody"), "first")
+
+    def test_falls_back_to_first_user_when_identifier_none(self) -> None:
+        users = [{"Id": "first", "Name": "admin"}]
+        with patch.object(JellyfinClient, "users", return_value=users):
+            self.assertEqual(self._client().resolve_user_id(None), "first")
+
+    def test_raises_when_no_users_visible(self) -> None:
+        with patch.object(JellyfinClient, "users", return_value=[]):
+            with self.assertRaises(RuntimeError):
+                self._client().resolve_user_id("admin")
+
+
+if __name__ == "__main__":
+    unittest.main()

backend/tests/test_qbittorrent_client.py

@@ -144,6 +144,36 @@ class QbittorrentClientTests(unittest.TestCase):
         assert call_kwargs["timeout"] == (5.0, 5.0)
         assert not isinstance(call_kwargs["timeout"], int)
 
+    def test_login_fails_message_names_bad_credentials(self) -> None:
+        """'Fails.' body yields a clear 'invalid username or password' error."""
+        self.session.post.return_value = self._login_response("Fails.")
+        with self.assertRaises(RuntimeError) as ctx:
+            self.client._login()
+        self.assertIn("invalid username or password", str(ctx.exception))
+
+    def test_login_accepts_sid_cookie_when_body_mangled(self) -> None:
+        """A reverse proxy that strips the body but forwards SID still logs in."""
+        resp = self._login_response("")  # empty body — the reported symptom
+        resp.cookies = {"SID": "abc123"}
+        self.session.post.return_value = resp
+
+        self.client._login()
+
+        self.assertTrue(self.client._logged_in)
+
+    def test_login_empty_body_without_cookie_is_diagnostic(self) -> None:
+        """Empty 200 body with no SID surfaces a URL/proxy diagnostic hint."""
+        resp = self._login_response("")
+        resp.cookies = {}  # no SID cookie forwarded
+        self.session.post.return_value = resp
+
+        with self.assertRaises(RuntimeError) as ctx:
+            self.client._login()
+
+        message = str(ctx.exception)
+        self.assertIn("HTTP 200", message)
+        self.assertIn("base_url", message)
+
 
 if __name__ == "__main__":
     unittest.main()