settings: show who exists on each side, and which pairs are the same person

Provisioning was invisible. Connecting a server can create accounts, adopt accounts and leave
accounts alone, and the only record of which happened was a JSON field in a response nobody reads and
rows in a table nobody can see. "Did it work" could only be answered by opening Jellyfin and counting.

The nav entry is Settings rather than Connection, since it is now more than the connection.

The join is computed in the sidecar and shares `normalize` with the reconcile planner, so the screen
cannot disagree with the matching rule about whether Diogo and diogo are one person — a settings page
saying two would be lying about what the next connection will do. It joins by the link ROW first and
by folded name only where none exists: a recorded pairing is a fact, a matching name is a candidate.

Four states, because they mean different things — linked (adopted or created), names match but not
recorded yet, Officer account with no Jellyfin one, and a Jellyfin account with no Officer user. The
last is never touched, and a linked pairing whose Jellyfin account has vanished is shown as such
rather than silently re-matched by name.

"Not known" is kept distinct from "none": if the platform has not sent the account list, or the
server cannot be reached, it says so instead of rendering an empty table that would read as a fact
about the server.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

web/useJellyfinData.ts

@@ -278,6 +278,35 @@ export function useJellyfinServers() {
   });
 }
 
+export type AccountPair = {
+  officer: { id: number; username: string | null; name: string | null; role: string } | null;
+  jellyfin: { id: string; name: string } | null;
+  linked: boolean;
+  adopted: boolean;
+  matchable: boolean;
+};
+
+export type AccountView =
+  | { known: false; reason: string }
+  | { known: true; pairs: AccountPair[]; counts: { linked: number; officerOnly: number; jellyfinOnly: number } };
+
+/**
+ * Who exists on each side of one server, and which pairs are the same person.
+ *
+ * Not cached beyond a few seconds: the reason to look at this is usually that somebody changed something
+ * in Jellyfin's own UI, and a stale answer is the one failure this screen exists to prevent.
+ */
+export function useJellyfinAccounts(serverId: number | null) {
+  const { get } = useClient();
+  return useQuery({
+    queryKey: [KEY, 'accounts', serverId],
+    queryFn: () => get<AccountView>(`/jellyfin/_config/${serverId}/users`),
+    enabled: serverId !== null,
+    staleTime: 5_000,
+    retry: false,
+  });
+}
+
 export type AddServerInput = { label: string; url: string; username: string; password: string };
 export type EditServerInput = { id: number; label?: string; url?: string; username?: string; password?: string };