Jellyfin refs on the wire + guest relay (proto 7)

- Media can be a Jellyfin ref {serverId, itemId, mediaSourceId, title,
  subtitle, runtimeSecs}; the server never stores or broadcasts a URL
  or token for it.
- Optional server-side Jellyfin credential (serve map / --jellyfin
  file) enables GET /j/<sid>/<token>/<itemId>: range-faithful proxy of
  the active item only, exact client header fields, upstream aborted on
  disconnect, bytes counted. welcome.relayUrl / state.relay advertise it.
- Members report jf access (own account vs relay).
- /m now sends the real Content-Type (Relic overrode it).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

packages/server/test/server_auth_test.dart

@@ -18,7 +18,7 @@ void main() {
     setUp(() async {
       bytes = Uint8List.fromList(List<int>.generate(8192, (i) => i % 251));
       file = File(
-          '${Directory.systemTemp.path}/server_test_${DateTime.now().microsecondsSinceEpoch}.bin');
+          '${Directory.systemTemp.path}/server_test_${DateTime.now().microsecondsSinceEpoch}.mkv');
       await file.writeAsBytes(bytes);
       server = SyncServer(AppConfig(
           port: 0, secret: 'shh', name: 'test', mediaPath: file.path));
@@ -117,6 +117,8 @@ void main() {
       resp = await mediaGet('/m/default/$token/$name', range: 'bytes=0-99');
       expect(resp.statusCode, 206);
       expect(resp.headers.value('content-range'), 'bytes 0-99/8192');
+      expect(resp.headers.contentType?.mimeType, contentTypeForFile(name));
+      expect(contentTypeForFile(name), isNot('application/octet-stream'));
       final body = <int>[];
       await for (final c in resp) {
         body.addAll(c);