Jellyfin refs on the wire + guest relay (proto 7)

- Media can be a Jellyfin ref {serverId, itemId, mediaSourceId, title,
  subtitle, runtimeSecs}; the server never stores or broadcasts a URL
  or token for it.
- Optional server-side Jellyfin credential (serve map / --jellyfin
  file) enables GET /j/<sid>/<token>/<itemId>: range-faithful proxy of
  the active item only, exact client header fields, upstream aborted on
  disconnect, bytes counted. welcome.relayUrl / state.relay advertise it.
- Members report jf access (own account vs relay).
- /m now sends the real Content-Type (Relic overrode it).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

packages/server/lib/src/session.dart

@@ -30,6 +30,8 @@ class SessionMedia {
   final double duration;
   final String? url;
   final File? file;
+  /// Jellyfin media by reference; never together with [url] or [file].
+  final JellyfinRef? jellyfin;
   final int mediaId;
   const SessionMedia({
     required this.name,
@@ -37,6 +39,7 @@ class SessionMedia {
     required this.duration,
     this.url,
     this.file,
+    this.jellyfin,
     this.mediaId = 1,
   });
 }