feat: initial Jellyfin OIDC auth plugin

OpenID Connect SSO for Jellyfin 10.10 (net8.0). Authorization code flow
with PKCE via IdentityModel.OidcClient, automatic user creation with
random password, role based admin/access mapping, plugin repo manifest.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Jellyfin.Plugin.OidcAuth/Configuration/PluginConfiguration.cs

@@ -0,0 +1,71 @@
+using MediaBrowser.Model.Plugins;
+
+namespace Jellyfin.Plugin.OidcAuth.Configuration;
+
+/// <summary>
+/// Plugin configuration for OIDC authentication.
+/// </summary>
+public class PluginConfiguration : BasePluginConfiguration
+{
+    /// <summary>
+    /// Gets or sets the OIDC issuer URL (authority). Discovery document is fetched from
+    /// {issuer}/.well-known/openid-configuration.
+    /// </summary>
+    public string OidIssuer { get; set; } = string.Empty;
+
+    /// <summary>
+    /// Gets or sets the OIDC client id.
+    /// </summary>
+    public string OidClientId { get; set; } = string.Empty;
+
+    /// <summary>
+    /// Gets or sets the OIDC client secret.
+    /// </summary>
+    public string OidClientSecret { get; set; } = string.Empty;
+
+    /// <summary>
+    /// Gets or sets the requested scopes, space separated.
+    /// </summary>
+    public string OidScopes { get; set; } = "openid profile email";
+
+    /// <summary>
+    /// Gets or sets the claim used as the Jellyfin username.
+    /// </summary>
+    public string UsernameClaim { get; set; } = "preferred_username";
+
+    /// <summary>
+    /// Gets or sets the claim containing the user's roles/groups.
+    /// </summary>
+    public string RoleClaim { get; set; } = "groups";
+
+    /// <summary>
+    /// Gets or sets a comma separated list of role/group values that grant Jellyfin
+    /// administrator rights. When empty, admin status is never modified by the plugin.
+    /// </summary>
+    public string AdminRoles { get; set; } = string.Empty;
+
+    /// <summary>
+    /// Gets or sets a comma separated list of role/group values required to log in.
+    /// When empty, every authenticated user may log in.
+    /// </summary>
+    public string AllowedRoles { get; set; } = string.Empty;
+
+    /// <summary>
+    /// Gets or sets a value indicating whether unknown users are created on first login.
+    /// </summary>
+    public bool CreateUsersIfMissing { get; set; } = true;
+
+    /// <summary>
+    /// Gets or sets a value indicating whether auto-created users get a random password.
+    /// Without one, Jellyfin accepts a blank password for them from any client.
+    /// Users can still set their own password in the web profile for TV/native logins,
+    /// or use Quick Connect.
+    /// </summary>
+    public bool SetRandomPasswordOnCreate { get; set; } = true;
+
+    /// <summary>
+    /// Gets or sets a value indicating whether strict discovery endpoint validation is disabled.
+    /// Required for providers whose endpoints live on a different host than the issuer (e.g. Google).
+    /// </summary>
+    public bool DisableEndpointValidation { get; set; }
+}