Block plugin routes for share guests (#16)

* block plugin routes for share guests

Adds a global MVC filter that refuses share-guest accounts on any plugin
controller. Jellyfin's own API stays open, the share tag policy already
bounds it and playback needs it.

Guests are identified by the auth provider marker on the account, so this
covers a leaked token used from curl or a native client, not just the web
client where the CSS lockdown runs.

* add plugin exception list and honest wording

Config page lists installed plugins with a checkbox each, for the ones that
need to answer guests during playback. Default is unticked.

Renames the hidden selectors setting to say it is cosmetic, and stops the
readme implying the web client lockdown confines anything.

* bump to 1.0.4.0

Jellyfin.Plugin.ShareLinks/Configuration/PluginConfiguration.cs

@@ -1,3 +1,4 @@
+using System;
 using MediaBrowser.Model.Plugins;
 
 namespace Jellyfin.Plugin.ShareLinks.Configuration;
@@ -52,6 +53,26 @@ public class PluginConfiguration : BasePluginConfiguration
     /// Gets or sets a comma-separated list of CSS selectors that are hidden from guest
     /// sessions in the web client. Used to suppress other plugins' injected UI (search
     /// bars, floating buttons) so a guest only sees the shared title. Empty by default.
+    ///
+    /// This is cosmetic only. It runs in the browser, so it tidies the guest's view but
+    /// enforces nothing: the access boundary is the share tag policy plus
+    /// <see cref="GuestPluginApiGuardEnabled"/>.
     /// </summary>
     public string GuestHiddenSelectors { get; set; } = string.Empty;
+
+    /// <summary>
+    /// Gets or sets a value indicating whether share guests are refused access to other
+    /// plugins' API endpoints. Jellyfin's own API stays reachable, since the share tag
+    /// policy already bounds it and playback depends on it. On by default: a guest holds
+    /// a real access token, so without this any installed plugin answers them directly.
+    /// </summary>
+    public bool GuestPluginApiGuardEnabled { get; set; } = true;
+
+    /// <summary>
+    /// Gets or sets the plugin ids that guests may reach despite the guard. Empty by
+    /// default, so a newly installed plugin is refused without anyone having to
+    /// remember it. Opt a plugin in when it genuinely needs to serve guests: an
+    /// intro-skip plugin, for instance, is called by the client mid-playback.
+    /// </summary>
+    public string[] GuestAllowedPluginIds { get; set; } = Array.Empty<string>();
 }