ShareLinks: make guest redemption actually work end to end

The sign-in bootstrap sent the auth request body as a JS object, so it
was coerced to [object Object] and AuthenticateByName returned 400. Send
JSON.stringify(...) instead.

Guest credentials were written to localStorage as a flat object under
made-up keys. jellyfin-web reads jellyfin_credentials as
{Servers:[{Id,AccessToken,UserId,...}]}, so the guest was treated as
logged out. Write that shape, pulling server Id/name from
System/Info/Public, and redirect with the 10.11 hash route
(#/details?id=...&serverId=...) instead of the legacy #!/ form that
rendered a blank page.

Creating a link now rejects folders and libraries (only movies and
episodes are shareable) so a guest cannot land on an empty tag-filtered
library. Item ids from the menu action are validated as GUIDs client
side, rejected creates are logged server side, malformed redeem tokens
return 404 instead of 500, and the admin table shows the item name and a
copyable link instead of the raw item id.

Jellyfin.Plugin.ShareLinks/Services/ShareTokenService.cs

@@ -44,16 +44,28 @@ public sealed class ShareTokenService
         };
     }
 
-    /// <summary>Computes the stored hash for a presented token.</summary>
-    public async Task<string> HashTokenAsync(string token, CancellationToken cancellationToken = default)
+    /// <summary>
+    /// Computes the stored hash for a presented token, or <see langword="null"/> if the token
+    /// is missing or not well-formed base64url (treated as "no match" rather than an error).
+    /// </summary>
+    public async Task<string?> HashTokenAsync(string token, CancellationToken cancellationToken = default)
     {
         if (string.IsNullOrWhiteSpace(token))
         {
-            throw new ArgumentException("Token cannot be empty.", nameof(token));
+            return null;
+        }
+
+        byte[] tokenBytes;
+        try
+        {
+            tokenBytes = Base64UrlDecode(token);
+        }
+        catch (FormatException)
+        {
+            return null;
         }
 
         var secret = await GetSecretAsync(cancellationToken).ConfigureAwait(false);
-        var tokenBytes = Base64UrlDecode(token);
         return ComputeHash(secret, tokenBytes);
     }
 
@@ -65,21 +77,15 @@ public sealed class ShareTokenService
             return false;
         }
 
-        try
-        {
-            var actualHash = await HashTokenAsync(token, cancellationToken).ConfigureAwait(false);
-            return CryptographicOperations.FixedTimeEquals(
-                Encoding.UTF8.GetBytes(actualHash),
-                Encoding.UTF8.GetBytes(expectedHash));
-        }
-        catch (ArgumentException)
-        {
-            return false;
-        }
-        catch (FormatException)
+        var actualHash = await HashTokenAsync(token, cancellationToken).ConfigureAwait(false);
+        if (actualHash is null)
         {
             return false;
         }
+
+        return CryptographicOperations.FixedTimeEquals(
+            Encoding.UTF8.GetBytes(actualHash),
+            Encoding.UTF8.GetBytes(expectedHash));
     }
 
     /// <summary>Encrypts sensitive text using the shared plugin secret.</summary>