fix(jellyfin): refuse a library that indexes files but fetches nothing

The Movies library had indexed 2,571 films and had never asked a provider
for a single one: no TMDb id, no plot, no rating, no poster. Nothing was
broken in the provider chain — the plugin is core in 12.4 and active, its
key is set, image.tmdb.org answers the container — and nothing was broken
in the write path: the overlay view has been read-write since the 2026-10-31
cutover, and movie.nfo lands on the NVMe upper layer today.

The state was two settings in the per-library option file,
config/root/default/<Library>/options.xml (Jellyfin 12 renamed it from
library.xml; the database stores none of these options, so a census that
greps for the old name and then queries the DB concludes nothing is
configured and goes hunting elsewhere):

  <EnableInternetProviders>false</EnableInternetProviders>
  <TypeOptions><ImageFetchers />   (empty, beside a populated
                                    <MetadataFetchers> and a fully
                                    populated <ImageFetcherOrder>)

With the internet switch off every refresh answers 204, stores nothing and
logs nothing, so the item count reads like a healthy scan — this passed the
deploy health gate, the Playwright suite and three agent audits. Order is
not enablement: the fetcher ORDER stays populated while the ENABLED set sits
empty, and the populated metadata list beside it makes the library look well.

verify now audits every library's options.xml and fails with `SILENT INDEX
<Library>: <what>` on providers-off or on a type whose image fetchers are
empty while its metadata fetchers are named; an options.xml that never
carried the switch (BoxSets, written before the property existed) is the
vendor default and stays accepted.

Vault: the page claimed artwork is a sidecar like movie.nfo. It is not — no
image saver is bound for any library, so art goes to the internal store and
Plex never reads it. The claim is corrected, and the RemoteImages diagnostic
that separates a provider fault from a library fault is written down with
the 12.x API shape traps (Items needs UserId; MetadataRefreshMode has no
Full/ValidationFailure, ReplaceAllMetadata=true is what re-runs providers).

tests/jellyfin_providers.bats

@@ -24,6 +24,9 @@
 #   9. no plugin configuration XML is tracked in git, the deployer places the
 #      keys BEFORE it restarts Jellyfin, and the planner routes a change to this
 #      installer to jellyfin.
+#  10. verify refuses a library that is a SILENT FILE INDEX — internet providers
+#      switched off, or a type whose ImageFetchers is empty while its
+#      MetadataFetchers list is populated (the 2026-11-01 missing-posters fault).
 
 load helpers
 
@@ -59,6 +62,32 @@ setup() {
     TRASH="$BATS_TEST_TMPDIR/trash"
     SEC="$BATS_TEST_TMPDIR/secrets"
     mkdir -p "$JF/plugins/configurations" "$TRASH" "$SEC"
+    # The per-library option file Jellyfin 12 owns (it was library.xml). Conforming
+    # by default so the pre-existing verify tests keep testing what they tested.
+    mkdir -p "$JF/root/default/Movies"
+    cat >"$JF/root/default/Movies/options.xml" <<XML
+<?xml version="1.0" encoding="utf-8"?>
+<LibraryOptions xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
+  <EnableInternetProviders>true</EnableInternetProviders>
+  <MetadataSavers>
+    <string>Nfo</string>
+  </MetadataSavers>
+  <TypeOptions>
+    <TypeOptions>
+      <Type>Movie</Type>
+      <MetadataFetchers>
+        <string>TheMovieDb</string>
+      </MetadataFetchers>
+      <ImageFetchers>
+        <string>TheMovieDb</string>
+      </ImageFetchers>
+      <ImageFetcherOrder>
+        <string>TheMovieDb</string>
+      </ImageFetcherOrder>
+    </TypeOptions>
+  </TypeOptions>
+</LibraryOptions>
+XML
     cat >"$JF/plugins/configurations/Jellyfin.Plugin.Tmdb.xml" <<XML
 <?xml version="1.0" encoding="utf-8"?>
 <Configuration xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
@@ -270,6 +299,69 @@ XML
     printf '%s\n' "${lines[@]}" | grep -qE 'TmdbApiKey .*[0-9]+ chars'
 }
 
+@test "verify refuses a library whose internet providers are switched off" {
+    # The whole library becomes a file index: refreshes answer 204 and store
+    # nothing, and the item count still looks like a healthy scan.
+    prov install >/dev/null
+    sed -i 's#<EnableInternetProviders>true</EnableInternetProviders>#<EnableInternetProviders>false</EnableInternetProviders>#' \
+        "$JF/root/default/Movies/options.xml"
+    run prov verify
+    [ "$status" -ne 0 ]
+    printf '%s\n' "${lines[@]}" | grep -qiF 'SILENT INDEX Movies'
+    printf '%s\n' "${lines[@]}" | grep -qiF 'EnableInternetProviders'
+}
+
+@test "verify refuses a type with no image fetchers while metadata fetchers are named" {
+    prov install >/dev/null
+    cat >"$JF/root/default/Movies/options.xml" <<XML
+<?xml version="1.0" encoding="utf-8"?>
+<LibraryOptions>
+  <EnableInternetProviders>true</EnableInternetProviders>
+  <TypeOptions>
+    <TypeOptions>
+      <Type>Movie</Type>
+      <MetadataFetchers>
+        <string>TheMovieDb</string>
+      </MetadataFetchers>
+      <ImageFetchers />
+      <ImageFetcherOrder>
+        <string>TheMovieDb</string>
+      </ImageFetcherOrder>
+    </TypeOptions>
+  </TypeOptions>
+</LibraryOptions>
+XML
+    run prov verify
+    [ "$status" -ne 0 ]
+    printf '%s\n' "${lines[@]}" | grep -qiF 'ImageFetchers empty'
+}
+
+@test "an older options.xml that never carried the switch is not refused" {
+    # BoxSets on this host were written before the property existed; absence is
+    # the vendor default, not a switched-off library, so it must not fail.
+    prov install >/dev/null
+    mkdir -p "$JF/root/default/Collections"
+    cat >"$JF/root/default/Collections/options.xml" <<XML
+<?xml version="1.0" encoding="utf-8"?>
+<LibraryOptions>
+  <TypeOptions>
+    <TypeOptions>
+      <Type>BoxSet</Type>
+      <MetadataFetchers>
+        <string>TheMovieDb</string>
+      </MetadataFetchers>
+      <ImageFetchers>
+        <string>TheMovieDb</string>
+      </ImageFetchers>
+    </TypeOptions>
+  </TypeOptions>
+</LibraryOptions>
+XML
+    run prov verify
+    [ "$status" -eq 0 ]
+    printf '%s\n' "${lines[@]}" | grep -qiF '= Collections'
+}
+
 @test "no plugin configuration XML is tracked in this repo" {
     # These files hold provider keys and are owned by the running container;
     # tracking them would put credentials in git and guarantee drift.