v1.2.2 — Passwordless login fix + user-menu link

Fixes

Passwordless / quick-profile login now hits 2FA

Many Jellyfin users have no password and sign in by clicking their avatar tile. v1.2.1 and earlier silently bypassed 2FA on this path because the standard web client didn't know how to handle our 401-with-challenge response.

The injected script now wraps both `fetch()` and `XMLHttpRequest`. When any of Jellyfin's auth endpoints (`AuthenticateByName`, `AuthenticateWithQuickConnect`, `/Users/{id}/Authenticate`) returns 401 with `twoFactorRequired:true`, the browser is redirected to the challenge page immediately. Manual login, avatar quick-login, and any custom auth flow are all covered.

Setup link in the user menu

Signed-in users can now click their avatar → "Two-Factor Auth" to reach `/TwoFactorAuth/Setup`. No more "normal user has nowhere to set it up."

Spinner clarification

Wrong-credential 401s now flow through to Jellyfin's normal error UI; the script only interferes when the 401 actually carries the 2FA challenge body.

Upgrade

Just install over v1.2.1. Hard-refresh your browser (Ctrl+Shift+R) after upgrade so the new `inject.js` loads instead of the cached old one.