v5.5.6

Fixed

• Jellyfin 12 support - Jellyfin 12 stopped parsing the legacy X-Emby-Token, X-MediaBrowser-Token and X-Emby-Authorization headers (jellyfin/jellyfin#15559), so every API call returned 401: the library never cached, no movie could be selected and sessions were never seen. All Jellyfin requests now use the standard Authorization: MediaBrowser ... header, which Jellyfin 10.x accepts as well, so no configuration changes are needed on either version
• Jellyfin login - /Users/AuthenticateByName was still sent with X-Emby-Authorization, which Jellyfin 12 rejects outright with a 400, so signing in with a Jellyfin account failed on the login page and in Settings

Thanks to @grasshide for the detailed report in #91.

Security

• Media server API keys no longer reach the browser - Jellyfin and Emby poster and backdrop URLs embedded the server-wide admin API key and were rendered straight into the page, so anyone who could open Movie Roulette, read the DOM, or read a proxy log obtained full API access to the media server. Artwork now goes through the app's existing same-origin image proxy, which also drops the assumption that the media server URL is reachable from the client, previously a problem when Movie Roulette talks to the server over an internal Docker network

Maintenance

• Removed JellyfinService.get_current_playback(), dead code that referenced a self.headers attribute the class never defines

Full Changelog: v5.5.5...v5.5.6