store the token provisioning mints, so members can open video

Provisioning already created each member's Jellyfin account and signed in as
them to get a token — its own header says the token exists so "the person's
Officer session can already read their library". It was then dropped, because
linkJellyfinAccount had nowhere to put it.

So every non-owner resolved to no config and got a 503 setup form, asking them
to connect a Jellyfin server with a password nobody knows. It reads as a
permissions fault and is not one: the grant, the role and the account list were
all correct.

jellyfin_accounts now carries access_token and device_id, getConfig falls back
to the link row when the caller has no registry of their own, and there is no
path from there to the owner's token — a member resolving to the owner's
credential would read the owner's watch state and every library.

POST /_config/:id/provision repairs accounts linked before the column existed.
It resets the password to mint, which is free on an account Officer created
(random, discarded, known to nobody) and destructive on an adopted one, so
adopted accounts are skipped unless includeAdopted says otherwise.

Applied on alpha: conceiba and guipinto minted and verified against the live
server; fedra and diogo skipped as adopted.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

sidecar/provision-run.ts

@@ -1,6 +1,7 @@
-import { listJellyfinAccounts, linkJellyfinAccount } from '../db';
-import { provision, type ProvisionOutcome } from './provision';
+import { listJellyfinAccounts, linkJellyfinAccount, setJellyfinAccountToken } from '../db';
+import { mintTokenForLinked, provision, type ProvisionOutcome } from './provision';
 import { getProvisionableUsers, hasProvisionableUsers } from './user-list';
+import { invalidateConfig, type UpstreamTarget } from './upstream';
 
 // The one place that turns "an admin just connected" into accounts on the server.
 //
@@ -68,6 +69,16 @@ export async function runProvisioning(params: {
         jellyfinUsername: made.username,
         adopted: false,
       });
+      // The token, which is the half that makes the account reachable. Written as a second statement
+      // because `linkJellyfinAccount` does nothing on conflict — see `setJellyfinAccountToken`. Without
+      // this the person has a Jellyfin account, a link row, and no way to open either.
+      await setJellyfinAccountToken({
+        userId: made.userId,
+        serverId,
+        accessToken: made.token,
+        deviceId: made.deviceId,
+      });
+      invalidateConfig(made.userId);
     }
 
     for (const line of outcome.log) console.log(`[jellyfin:provision] ${line}`);
@@ -87,3 +98,70 @@ export async function runProvisioning(params: {
     return { ran: false, reason };
   }
 }
+
+export type BackfillReport = {
+  minted: string[];
+  /** Already had a token. Reported rather than silent, so a re-run visibly does nothing. */
+  alreadyLinked: string[];
+  /** Adopted accounts left alone, and why — the owner has to choose before these can be touched. */
+  skipped: { username: string; reason: string }[];
+  failed: { username: string; error: string }[];
+};
+
+/**
+ * Give a token to every linked account that has none.
+ *
+ * This is the repair for accounts provisioned BEFORE `jellyfin_accounts.access_token` existed. Those rows
+ * record a real Jellyfin account and a real pairing — the only missing piece is the credential, which was
+ * minted at the time and discarded. Nothing here creates or deletes an account; it only fills the gap.
+ *
+ * Idempotent, and cheap when there is nothing to do: an account that already has a token is skipped
+ * without a single upstream call, so this is safe to run on every re-provision.
+ *
+ * `includeAdopted` defaults to FALSE and that default is the safety property. Minting for an adopted
+ * account means resetting a password its owner knows and may use to sign into Jellyfin directly — see
+ * `mintTokenForLinked`. Turning it on is a decision about somebody else's account, so it is never the
+ * default and never inferred.
+ */
+export async function backfillAccountTokens(params: {
+  cfg: UpstreamTarget;
+  serverId: number;
+  includeAdopted?: boolean;
+}): Promise<BackfillReport> {
+  const { cfg, serverId, includeAdopted = false } = params;
+  const report: BackfillReport = { minted: [], alreadyLinked: [], skipped: [], failed: [] };
+
+  for (const account of await listJellyfinAccounts(serverId)) {
+    if (account.hasToken) {
+      report.alreadyLinked.push(account.jellyfinUsername);
+      continue;
+    }
+    if (account.adopted && !includeAdopted) {
+      report.skipped.push({
+        username: account.jellyfinUsername,
+        reason: 'this account existed before Officer, so its password is theirs — resetting it would lock them out of Jellyfin itself',
+      });
+      continue;
+    }
+
+    try {
+      const { token, deviceId } = await mintTokenForLinked(cfg, {
+        officerUserId: account.userId,
+        jellyfinUserId: account.jellyfinUserId,
+        username: account.jellyfinUsername,
+      });
+      await setJellyfinAccountToken({ userId: account.userId, serverId, accessToken: token, deviceId });
+      // Their cached config says "nothing configured" and would hold that for up to a minute. They are
+      // most likely staring at the setup form right now, so drop it immediately.
+      invalidateConfig(account.userId);
+      report.minted.push(account.jellyfinUsername);
+      console.log(`[jellyfin:provision] minted a token for ${account.jellyfinUsername}`);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      report.failed.push({ username: account.jellyfinUsername, error: message });
+      console.error(`[jellyfin:provision] ${account.jellyfinUsername}: ${message}`);
+    }
+  }
+
+  return report;
+}