fix: resolve Jellyfin usernames to internal Id and harden qBittorrent login

Jellyfin: get_user_id() returned the configured user_id verbatim, so a
username like "admin" hit /Users/admin/Views and got HTTP 400 ("The value
'admin' is not valid."). The index worker already had username->Id
resolution, but the live API paths (dashboard counts, media query) did not.
Route all user-scoped paths through the new JellyfinClient.resolve_user_id()
(exact Id match -> Name match -> first user), cached per service/credentials
in get_user_id() so repeated requests don't re-list users. The worker is
simplified to call the same method.

qBittorrent: _login() raised "qBittorrent login failed: " (empty) on a 200
with an empty body, which happens when base_url doesn't reach the qBittorrent
login handler (wrong URL/path or a reverse proxy misroute) — not a credentials
issue. Now accepts the SID cookie as a success signal (reverse proxies that
mangle the body), returns a clear "invalid username or password" for "Fails.",
and surfaces a diagnostic error (HTTP status + body + base_url/proxy hint) for
any other/empty body.

Tests: new tests/test_jellyfin_client.py (5) + 3 qBittorrent login tests.
Full backend suite (384) passes; ruff clean.

backend/tests/test_qbittorrent_client.py

@@ -144,6 +144,36 @@ class QbittorrentClientTests(unittest.TestCase):
         assert call_kwargs["timeout"] == (5.0, 5.0)
         assert not isinstance(call_kwargs["timeout"], int)
 
+    def test_login_fails_message_names_bad_credentials(self) -> None:
+        """'Fails.' body yields a clear 'invalid username or password' error."""
+        self.session.post.return_value = self._login_response("Fails.")
+        with self.assertRaises(RuntimeError) as ctx:
+            self.client._login()
+        self.assertIn("invalid username or password", str(ctx.exception))
+
+    def test_login_accepts_sid_cookie_when_body_mangled(self) -> None:
+        """A reverse proxy that strips the body but forwards SID still logs in."""
+        resp = self._login_response("")  # empty body — the reported symptom
+        resp.cookies = {"SID": "abc123"}
+        self.session.post.return_value = resp
+
+        self.client._login()
+
+        self.assertTrue(self.client._logged_in)
+
+    def test_login_empty_body_without_cookie_is_diagnostic(self) -> None:
+        """Empty 200 body with no SID surfaces a URL/proxy diagnostic hint."""
+        resp = self._login_response("")
+        resp.cookies = {}  # no SID cookie forwarded
+        self.session.post.return_value = resp
+
+        with self.assertRaises(RuntimeError) as ctx:
+            self.client._login()
+
+        message = str(ctx.exception)
+        self.assertIn("HTTP 200", message)
+        self.assertIn("base_url", message)
+
 
 if __name__ == "__main__":
     unittest.main()