fix(jellyfin): realign the administrator password the wizard can no longer set

seed_admin_and_get_token only ever drove the startup wizard, and that wizard works
exactly once: on a server that is not yet provisioned. After the first deploy the
/Startup/* endpoints are closed and the administrator carries whatever password the
inventory held at install time, so a rotated credential leaves the account
unreachable. The CI rotates every credential between the sync and the async pass,
which is why job 99275699298 spent its 40 attempts on

    curl: (22) The requested URL returned error: 401

and then failed with the script's own diagnosis: "the administrator cannot
authenticate after wizard retries; the deployed password does not match the running
server". The script named the cause correctly and had no way back.

realign_admin_password runs only after the wizard loop is exhausted and uses
Jellyfin's documented local recovery. Read from the server's own source rather than
assumed:

  UserController.ForgotPassword          writes the pin file only when the request
                                         is local (IsLocal || IsInLocalNetwork)
  DefaultPasswordResetProvider:100       ProgramDataPath/passwordreset<md5>.json,
                                         serialized without options, so key "Pin"
  DefaultPasswordResetProvider:77        ChangePassword(resetUser.Id, pin)

That last line is the one that matters: redeeming the pin sets the password TO the
pin, it does not clear it. The pin is therefore both the credential to authenticate
with afterwards and the CurrentPw of the change that follows. A first draft logged
in with an empty password and would have failed on every run while passing every
lint.

Two shell corrections came out of the same pass. get_token now takes the password as
an argument, because reading it from the environment invited
`JELLYFIN_ADMIN_PASSWORD="" get_token`, where an assignment prefixed to a function
call can outlive the call. And the three captured values now guard with
`x="$(cmd)" || x=""` instead of one of them carrying `|| true` and the others none:
under set -euo pipefail the unguarded assignments aborted the script before the
emptiness check below them could report anything.

Worst case is the status quo: nothing here runs unless the deploy was already lost.

Same shape as 82452789c9 did for the homeassistant owner.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

roles/web-app-jellyfin/files/shell/configure-auth.sh

@@ -30,10 +30,40 @@ complete_wizard() {
 
 get_token() {
   ${CURL} -fsS -X POST "${API}/Users/AuthenticateByName" -H "Content-Type: application/json" -H "${CLIENT_HDR}" \
-    -d "{\"Username\":\"${JELLYFIN_ADMIN_USERNAME}\",\"Pw\":\"${JELLYFIN_ADMIN_PASSWORD}\"}" \
+    -d "{\"Username\":\"${JELLYFIN_ADMIN_USERNAME}\",\"Pw\":\"${1-${JELLYFIN_ADMIN_PASSWORD}}\"}" \
     | sed -n 's/.*"AccessToken":"\([^"]*\)".*/\1/p'
 }
 
+get_user_id() {
+  ${CURL} -fsS -X POST "${API}/Users/AuthenticateByName" -H "Content-Type: application/json" -H "${CLIENT_HDR}" \
+    -d "{\"Username\":\"${JELLYFIN_ADMIN_USERNAME}\",\"Pw\":\"$1\"}" \
+    | sed -n 's/.*"User":{[^}]*"Id":"\([^"]*\)".*/\1/p'
+}
+
+realign_admin_password() {
+  local pin pin_token user_id
+  ${CURL} -fsS -X POST "${API}/Users/ForgotPassword" -H "Content-Type: application/json" -H "${CLIENT_HDR}" \
+    -d "{\"EnteredUsername\":\"${JELLYFIN_ADMIN_USERNAME}\"}" >/dev/null || return 1
+  pin="$(container exec "${CT}" sh -c 'cat /config/data/passwordreset*.json 2>/dev/null' \
+    | sed -n 's/.*"Pin":"\([^"]*\)".*/\1/p' | head -n1)" || pin=""
+  if [ -z "${pin}" ]; then
+    log "ERROR: Jellyfin accepted the reset request but wrote no pin file"
+    return 1
+  fi
+  ${CURL} -fsS -X POST "${API}/Users/ForgotPassword/Pin" -H "Content-Type: application/json" -H "${CLIENT_HDR}" \
+    -d "{\"Pin\":\"${pin}\"}" >/dev/null || return 1
+  pin_token="$(get_token "${pin}")" || pin_token=""
+  user_id="$(get_user_id "${pin}")" || user_id=""
+  if [ -z "${pin_token}" ] || [ -z "${user_id}" ]; then
+    log "ERROR: the administrator does not authenticate with the reset pin"
+    return 1
+  fi
+  ${CURL} -fsS -X POST "${API}/Users/${user_id}/Password" -H "Content-Type: application/json" \
+    -H "Authorization: MediaBrowser Token=\"${pin_token}\"" \
+    -d "{\"CurrentPw\":\"${pin}\",\"NewPw\":\"${JELLYFIN_ADMIN_PASSWORD}\"}" >/dev/null || return 1
+  log "realigned the administrator password with the one this deployment declares"
+}
+
 seed_admin_and_get_token() {
   for _ in $(seq 1 40); do
     complete_wizard
@@ -41,6 +71,9 @@ seed_admin_and_get_token() {
     [ -n "${TOKEN:-}" ] && return 0
     sleep 3
   done
+  realign_admin_password || return 1
+  TOKEN="$(get_token)" || TOKEN=""
+  [ -n "${TOKEN:-}" ] && return 0
   return 1
 }