Sharing one season let the guest see every season of that show. Sharing a whole
series or a single episode was fine, which is what made it look like a season
specific problem.
The cause is that the tag went upwards as well as downwards. BuildTagTreeTargets
added a season's parent series, so the guest's tag landed on the series itself,
and Jellyfin's GetInheritedTags is an item's own tags plus every ancestor's, with
AllowedTags matched against that. Tagging the series therefore made every other
season and episode under it inherit the tag and become visible. Sharing a series
looked correct because the whole show is meant to be visible, and sharing an
episode looked correct because nothing above it was ever tagged.
Tagging now only ever goes down: the shared item, and its descendants when it is a
folder. A guest sent one season gets that season and its episodes, and the series
page is not theirs to open, which is what sharing a season should mean.
Removal deliberately still reaches up to the parent series. Links created by
earlier builds put the tag there, and taking a tag off can only remove access, so
those get cleaned up when the link expires or is revoked instead of being stranded
on the series forever.