provision when the account list changes, not only when you connect

Same gap as the photos plugin: users:list updated an in-memory array and
nothing acted on it, so a person added to Officer later reached Video only if
somebody re-ran provisioning by hand. The platform broadcasts on every create
and delete and re-sends on every registration — nothing was listening.

Safe to run unattended without changing what it does, because runProvisioning
already draws the line in the right place: it creates the missing accounts and
tokens them, and it RECORDS an adopted account without touching it. Minting for
an adopted account resets a password its owner knows, and that stays behind
includeAdopted, which only a person can ask for.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

sidecar/index.ts

@@ -5,6 +5,7 @@ import { handleBytesRoute, handleOfficerRoute } from './routes';
 import { getConfig, probe } from './upstream';
 import { API_URL } from '@@/officer-url.mjs';
 import { setProvisionableUsers } from './user-list';
+import { provisionForAccountChange } from './provision-run';
 
 // The officer-jellyfin sidecar. Owns the whole Jellyfin contract for Officer: the instance URL, the access
 // token, the Jellyfin user it belongs to and the DeviceId its sessions are keyed by. The platform API is a
@@ -146,6 +147,10 @@ function handleCommand(cmd: SidecarCommand, reply: ReplyFn) {
     // not a question.
     case 'users:list':
       setProvisionableUsers(cmd.users);
+      // And act on it. Detached deliberately: this reaches out to Jellyfin and can take seconds, while the
+      // command handler is on the socket the platform is waiting on. Nothing replies to `users:list`, so
+      // there is no answer to delay — but blocking here would stall every later message on this socket.
+      void provisionForAccountChange();
       break;
     default:
       reply({