5.0.0-JF12-beta

Jellyfin 12.0 (.NET 10) beta 5.0.0-JF12-beta (plugin version 5.0.0.43).
Install via the beta repository URL (a Jellyfin 12.0 server picks this build automatically by targetAbi):
https://raw.githubusercontent.com/Flowfin/jellyfin-plugin-sso/manifest-beta/manifest.json

Scope note (#743): the JF12/5.0 line is not validated against a live Jellyfin 12.0 server yet - no 12.0 GA server exists to run the E2E checklist against. It is CI-built and unit/conformance-tested only, and it is NOT part of the 4.x (Jellyfin 10.11) release-candidate gate; the 5.0 line clears its own live-validation gate when a Jellyfin 12.0 RC/GA build is available. Use these betas for testing, not production.

What's Changed

• Add a roles fuzz target and seed its repeated-key grammar [#1158] by @iderex in #1291
• Name the screened discovery refusal in Test connection [#1064] by @iderex in #1293
• Bound the provider-authored text in the discovery read's warning [#1194] by @iderex in #1294
• Refuse the roles when two copies of the role claim disagree [#1040] by @iderex in #1295
• Refuse a token whose JWS header marks an extension critical [#1038] by @iderex in #1296
• Pin that a repeated scalar aud collapses to the last occurrence [#1193] by @iderex in #1297
• Prove the non-parallel-collection rule can go red [#1173] by @iderex in #1298
• Fold the untrusted-JSON rule into the conformance home [#1037] by @iderex in #1299
• Retry the logout discovery read inside a stated budget [#1183] by @iderex in #1300
• Audit a refused role claim with its reason and never its value [#1149] by @iderex in #1301
• Rewrite the em dash out of the admin page and the translation surface by @iderex in #1302
• Pin the OIDC redirect_uri to one builder over one canonical base by @iderex in #1304
• Pin the OpenID validation basis to one file and one algorithm set by @iderex in #1305
• Name each logout_token refusal instead of collapsing eleven into one by @iderex in #1306
• Name the repeated member in the refusal entry, neutralised at the log call [#1195] by @iderex in #1307
• Build every OpenID client with its discovery metadata already set [#1067] by @iderex in #1308

Full Changelog: 4.3.0-beta.28...5.0.0-JF12-beta.43