v1.3.1: MAJOR FIX - fix auto logging out behavior, harden Jellyfin Auth, block bot probes earlier, let Jellyfin handle playback sessions, add [E] tag to explicit external tracks

allstarr.Tests/JellyfinProxyServiceTests.cs

@@ -117,6 +117,35 @@ public class JellyfinProxyServiceTests
         Assert.False(captured.Headers.Contains("X-Emby-Authorization"));
     }
 
+    [Fact]
+    public async Task GetJsonAsync_WithXEmbyToken_ForwardsTokenHeader()
+    {
+        // Arrange
+        HttpRequestMessage? captured = null;
+        _mockHandler.Protected()
+            .Setup<Task<HttpResponseMessage>>("SendAsync",
+                ItExpr.IsAny<HttpRequestMessage>(),
+                ItExpr.IsAny<CancellationToken>())
+            .Callback<HttpRequestMessage, CancellationToken>((req, ct) => captured = req)
+            .ReturnsAsync(new HttpResponseMessage(HttpStatusCode.OK)
+            {
+                Content = new StringContent("{}")
+            });
+
+        var headers = new HeaderDictionary
+        {
+            ["X-Emby-Token"] = "token-123"
+        };
+
+        // Act
+        await _service.GetJsonAsync("Items", null, headers);
+
+        // Assert
+        Assert.NotNull(captured);
+        Assert.True(captured!.Headers.TryGetValues("X-Emby-Token", out var values));
+        Assert.Contains("token-123", values);
+    }
+
     [Fact]
     public async Task GetBytesAsync_ReturnsBodyAndContentType()
     {