fix: resolve Jellyfin usernames to internal Id and harden qBittorrent login

Jellyfin: get_user_id() returned the configured user_id verbatim, so a
username like "admin" hit /Users/admin/Views and got HTTP 400 ("The value
'admin' is not valid."). The index worker already had username->Id
resolution, but the live API paths (dashboard counts, media query) did not.
Route all user-scoped paths through the new JellyfinClient.resolve_user_id()
(exact Id match -> Name match -> first user), cached per service/credentials
in get_user_id() so repeated requests don't re-list users. The worker is
simplified to call the same method.

qBittorrent: _login() raised "qBittorrent login failed: " (empty) on a 200
with an empty body, which happens when base_url doesn't reach the qBittorrent
login handler (wrong URL/path or a reverse proxy misroute) — not a credentials
issue. Now accepts the SID cookie as a success signal (reverse proxies that
mangle the body), returns a clear "invalid username or password" for "Fails.",
and surfaces a diagnostic error (HTTP status + body + base_url/proxy hint) for
any other/empty body.

Tests: new tests/test_jellyfin_client.py (5) + 3 qBittorrent login tests.
Full backend suite (384) passes; ruff clean.

backend/tests/test_jellyfin_client.py

@@ -0,0 +1,53 @@
+"""Unit tests for JellyfinClient user-id resolution.
+
+Jellyfin's ``/Users/{id}/...`` endpoints require the internal user Id (a hash),
+not the username. The service ``user_id`` config field accepts either form, so
+``resolve_user_id`` must turn a username like ``'admin'`` into the real Id before
+any user-scoped call. See clients/jellyfin.py.
+"""
+
+from __future__ import annotations
+
+import unittest
+from unittest.mock import patch
+
+from media_library_viewer_api.clients.jellyfin import JellyfinClient
+
+
+class ResolveUserIdTests(unittest.TestCase):
+    def _client(self) -> JellyfinClient:
+        return JellyfinClient("https://jf.example.com", "api-key")
+
+    def test_returns_identifier_when_it_matches_an_internal_id(self) -> None:
+        users = [{"Id": "a1b2", "Name": "admin"}, {"Id": "c3d4", "Name": "friend"}]
+        with patch.object(JellyfinClient, "users", return_value=users):
+            self.assertEqual(self._client().resolve_user_id("c3d4"), "c3d4")
+
+    def test_resolves_username_to_internal_id(self) -> None:
+        """Regression: a configured username 'admin' must resolve to the internal Id.
+
+        Hitting /Users/admin/Views directly returns HTTP 400
+        ('The value 'admin' is not valid.'), so the username form must be resolved.
+        """
+        users = [{"Id": "a1b2c3internal", "Name": "admin"}, {"Id": "zzz", "Name": "other"}]
+        with patch.object(JellyfinClient, "users", return_value=users):
+            self.assertEqual(self._client().resolve_user_id("admin"), "a1b2c3internal")
+
+    def test_falls_back_to_first_user_when_identifier_unknown(self) -> None:
+        users = [{"Id": "first", "Name": "admin"}, {"Id": "second", "Name": "x"}]
+        with patch.object(JellyfinClient, "users", return_value=users):
+            self.assertEqual(self._client().resolve_user_id("nobody"), "first")
+
+    def test_falls_back_to_first_user_when_identifier_none(self) -> None:
+        users = [{"Id": "first", "Name": "admin"}]
+        with patch.object(JellyfinClient, "users", return_value=users):
+            self.assertEqual(self._client().resolve_user_id(None), "first")
+
+    def test_raises_when_no_users_visible(self) -> None:
+        with patch.object(JellyfinClient, "users", return_value=[]):
+            with self.assertRaises(RuntimeError):
+                self._client().resolve_user_id("admin")
+
+
+if __name__ == "__main__":
+    unittest.main()