4.2.1-beta

Jellyfin 10.11 beta 4.2.1-beta (plugin version 4.2.1.7).
Install via the beta repository URL:
https://raw.githubusercontent.com/iderex/jellyfin-plugin-sso/manifest-beta/manifest.json

What's Changed

• Show link success instead of "Login failed" after account linking (#614) by @iderex in #639
• Fix .NET CI startup_failure on 4.3 (reusable build.yml permissions) by @iderex in #644
• Document the reusable build.yml caller-permission contract by @iderex in #647
• Record single-logout design constraints (#154) by @iderex in #648
• Document the review-gate coverage after external-reviewer removal (#101) by @iderex in #649
• Derive the DORA four keys from git/GitHub (#175) by @iderex in #650
• Conformance test: build-*.yaml artifacts equal the per-TFM publish closure (#608) by @iderex in #651
• Document and drill the release rollback path (#151) by @iderex in #652
• Threat-model SSO-only login before building (Refs #165) by @iderex in #653
• Add the JF12 stable publish leg (#607) by @iderex in #654
• Add the AI-delivery-pipeline threat model; classify agent-config as sensitive (#152) by @iderex in #656
• Consolidate the milestone branches (P4/P5/P5b/P6 work) onto main by @iderex in #657
• Share the publish-manifest-release concurrency group (#655) by @iderex in #658
• Formalize the daily beta as the release canary soak stage (#172) by @iderex in #659
• OpenSSF Best Practices criteria mapping + badge readiness (#403) by @iderex in #660
• Advisory deterministic PR-hygiene checks (#171) by @iderex in #661
• Full RBAC mapping: SSO claims -> PermissionKind (default-deny) (#164) by @iderex in #662
• Move design/process/architecture docs to the wiki; keep only required files by @iderex in #663
• Make the PR-hygiene size check advisory (WARN, never FAIL) by @iderex in #664
• Widen unicode-guard to all branches; tidy publish-pipeline config by @iderex in #691
• Correct stale version references in README and CHANGELOG by @iderex in #692

Full Changelog: 4.2.1-stable...4.2.1-beta.7