fix(jellyfin): use correct two-step QuickConnect authentication flow

[koinsaari]

/QuickConnect/Authenticate isn't a real Jellyfin endpoint — it only reports approval state and never returns a token. A prior commit worked around this by treating its 400 response as "pending," which masked the real problem.

Summary

• Poll /QuickConnect/Connect for Authenticated state
• Once approved, exchange the secret for a token via /Users/AuthenticateWithQuickConnect
• Update client and adapter tests to mock both endpoints

Implementation notes

Supersedes the 400-as-pending workaround from f0c9957 — that logic is now gone, replaced by the real two-call protocol.

🤖 Generated with Claude Code

[github-actions]

Reviewing PR #57

• Read REVIEW.md and CLAUDE.md
• Review diff (quickconnect.go, adapter_test.go, quickconnect_test.go)
• Check import cycle rule (internal/auth vs internal/clients/jellyfin)
• Post findings and set commit status

View job run

[github-actions]

Claude finished @koinsaari's task in 1m 22s —— View job

---

Reviewing PR #57

• Read REVIEW.md and CLAUDE.md
• Review diff (quickconnect.go, adapter_test.go, quickconnect_test.go)
• Check import cycle rule (internal/auth vs internal/clients/jellyfin)
• Post findings and set commit status

No blocking issues. The two-step flow is implemented correctly:

• QuickConnect/Connect is polled via GET with secret as a query param, decoded into {Authenticated bool}, and ErrQuickConnectPending is returned when not yet approved — matches the actual Jellyfin contract described in the PR body.
• Once approved, Users/AuthenticateWithQuickConnect is called via POST with the secret in a JSON body, and the resulting AccessToken/User are decoded the same way the old single-call path did.
• URL construction uses url.JoinPath + url.Parse with errors handled (not fmt.Sprintf), consistent with CLAUDE.md.
• No import of internal/clients/jellyfin inside internal/auth — the isolation rule holds.
• Tests in quickconnect_test.go and adapter_test.go were updated to mock both endpoints and cover pending vs. approved paths.

🟡 Nit: both requests build authHeader("api-proxy-qc") independently — fine as-is, just noting it's not a hoisting issue since it's not a per-request closure.

Note: I was unable to run go build/go test/go vet in this sandbox (commands required approval that wasn't available in this context) — CI should confirm compilation and test pass, but the logic reads correct on inspection.