user provisioning, phase one: reconcile against the real server

the platform pushes the account list (users:list, declared by userProvisioning
in the manifest); this decides what to do about each one and does it.

DECIDING IS SEPARATE FROM DOING. reconcile.ts is pure and has no idea what
jellyfin is — which is why it can be tested against the real populations on
alpha without creating anything. nine tests, built on the actual overlap:
diogo and fedra already have jellyfin accounts, conceiba and guipinto do not,
rezio and peter exist only on jellyfin.

that test found a real bug before it shipped. officer's `username` was unique
CASE-SENSITIVELY, so `diogo` and `DIOGO` could both exist here while colliding
on jellyfin's uppercased NormalizedUsername index — and the first version
handed both the same jellyfin account, because it only checked links that
already existed rather than ones claimed during the pass. the platform side is
now case-insensitive too, so the collision cannot be created in the first
place; the guard stays because the constraint and the guard protect different
moments.

three outcomes, and the third is the point: LINK an account that already
exists, CREATE one that does not, LEAVE ALONE a jellyfin account with no
officer user. never delete. an absence in officer is indistinguishable from a
list that has not been told about someone yet, and a wrong deletion costs
somebody their watch history.

`adopted` carries that distinction into the mapping table. false means officer
made the account and may remove it; true means it existed first and was merely
linked.

NOBODY IS EVER TOLD THEIR PASSWORD. jellyfin has no must-change flag — verified
against its openapi, UserPolicy has 44 properties and none of them is one — so
a handed-over password stays valid forever. instead the generated one is used
once, immediately, to mint that person's own access token, and discarded. the
account exists and their officer session can already read their library.

which also makes rule 4 unskippable: the sign-in that verifies the account is
the same call that obtains the token, so there is no version of this that
"verifies later".

one failure does not stop the rest. a partially provisioned server is fixed by
running again; a run that aborts on the first error leaves everyone after them
unprovisioned and no record of who.

db/queries.ts

@@ -1,6 +1,6 @@
 import { eq, and, desc } from 'drizzle-orm';
 import { db } from 'officerdb/db';
-import { jellyfinServers } from './schema';
+import { jellyfinServers, jellyfinAccounts } from './schema';
 import { encryptSecret, decryptSecret } from 'officerdb/crypto';
 
 // Jellyfin server registry for the officer-jellyfin sidecar. Callers deal in PLAINTEXT — encryption to and
@@ -202,3 +202,60 @@ export async function recordJellyfinProbe(userId: number, id: number, version: s
     .set({ version, lastSeenAt: new Date(), updatedAt: new Date() })
     .where(and(eq(jellyfinServers.userId, userId), eq(jellyfinServers.id, id)));
 }
+
+// ── The Officer ↔ Jellyfin account mapping ──
+
+/** Links already recorded for one server, for the reconcile to compare against. */
+export async function listJellyfinAccounts(serverId: number): Promise<
+  { userId: number; jellyfinUserId: string; jellyfinUsername: string; adopted: boolean }[]
+> {
+  const rows = await db
+    .select({
+      userId: jellyfinAccounts.userId,
+      jellyfinUserId: jellyfinAccounts.jellyfinUserId,
+      jellyfinUsername: jellyfinAccounts.jellyfinUsername,
+      adopted: jellyfinAccounts.adopted,
+    })
+    .from(jellyfinAccounts)
+    .where(eq(jellyfinAccounts.serverId, serverId));
+  return rows;
+}
+
+/**
+ * Record a pairing.
+ *
+ * `onConflictDoNothing` on BOTH unique indexes, so a re-run is silent rather than an error — a second
+ * reconcile finding the same thing already true is the normal case, not a fault.
+ *
+ * `adopted` is the load-bearing field: false means Officer created this account and may remove it, true
+ * means it existed first and was merely linked. Deleting an adopted account would destroy someone's watch
+ * history because their Officer login went away.
+ */
+export async function linkJellyfinAccount(params: {
+  userId: number;
+  serverId: number;
+  jellyfinUserId: string;
+  jellyfinUsername: string;
+  adopted: boolean;
+}): Promise<void> {
+  await db
+    .insert(jellyfinAccounts)
+    .values({
+      userId: params.userId,
+      serverId: params.serverId,
+      jellyfinUserId: params.jellyfinUserId,
+      jellyfinUsername: params.jellyfinUsername,
+      // Mirrors Jellyfin's own `NormalizedUsername`, so matching is a lookup rather than a convention
+      // every call site has to remember.
+      normalizedUsername: params.jellyfinUsername.trim().toUpperCase(),
+      adopted: params.adopted,
+    })
+    .onConflictDoNothing();
+}
+
+/** Drop a pairing. Removes Officer's RECORD of the account, never the account itself. */
+export async function unlinkJellyfinAccount(userId: number, serverId: number): Promise<void> {
+  await db
+    .delete(jellyfinAccounts)
+    .where(and(eq(jellyfinAccounts.userId, userId), eq(jellyfinAccounts.serverId, serverId)));
+}