[GianniCarlo]

Fixes #1598.

What was wrong

Jellyfin 12 removed the GET route for /QuickConnect/Initiate; 12.0 and 12.1 only accept POST and answer GET with 405 Method Not Allowed. jellyfin-sdk-swift 0.4.0's QuickConnect controller starts the flow with GET (Paths.initiate), so Quick Connect fails before it shows a code on any 12.x server.

With #1603 (download auth) and #1604 (Narrator decoding) merged, this is the last part of #1598.

Jellyfin	GET /QuickConnect/Initiate	POST /QuickConnect/Initiate
10.8.13	200	405
10.9 – 10.11	200 (marked obsolete)	200
12.0 / 12.1	405	200

(From the server's QuickConnectController at each tag; 12.1.0 and 10.10.7 also checked live.)

Change

• jellyfin-sdk-swift 0.4.0 → 1.0.0. 1.0.0's controller starts with POST (Paths.initiateQuickConnect) and keeps the same public API: ObservableObject, @Published state, State, QuickConnectError, init(client:pollInterval:maxPolls:), start()/stop(). The view model and its tests don't change. The requirement stays up-to-next-major, now 1.0.0..<2.0.0, which keeps out 2.x and its swift-nio dependencies. In Package.resolved only the JellyfinAPI pin changes; Get 2.2.1 and URLQueryEncoder 0.2.1 stay.
• Access token goes in JellyfinClient.Configuration. 1.0.0 deprecates passing it to the JellyfinClient initializer. BookPlayer only reads client.accessToken, so nothing else changes.
• Comments and CLAUDE.md. 1.0.0 still has no narrator PersonKind (it arrives in 3.0.0), so Decode Jellyfin items with unknown person kinds #1604's lenient decode stays. Its two comments now say "before SDK 3.0" instead of "SDK 0.4". The dependency list in CLAUDE.md says ~1.0.

1.0.0 also includes the 0.5.3 fix for a retain cycle that leaked every JellyfinClient.

Older servers: 10.8 was already unsupported (0.4.0 needs /UserViews and /Items/{id}, which arrived in 10.9), and 1.0.0 calls the same routes.

Verification

• Build for testing and the Unit Tests plan on an iPhone 17 simulator (iOS 27.0): 554/554 pass, no JellyfinClient deprecation warnings left.
• Live Quick Connect through BookPlayer's own code, against fresh Jellyfin 12.1.0 and 10.10.7 containers: a temporary test (not in this PR) drove JellyfinConnectionViewModel and JellyfinConnectionService. It connected to the server, started Quick Connect and got a code, approved the code as the server admin, waited for sign-in, checked the saved connection's user, and loaded the libraries with the new token. It passed on both servers. On 0.4.0 the same start request gets 405 on 12.1.
• Not done: tapping through the Quick Connect sheet by hand. No sheet code changes; the sheet only renders the view-model state the live test exercised.

[github-actions]

✅ Claude PR Review — PASS

This PR upgrades jellyfin-sdk-swift from 0.4.0 to 1.0.0 (project.pbxproj + Package.resolved) and migrates the single affected call site in JellyfinConnectionService.makeClientAndInjector to the SDK 1.0 API, which moves accessToken from the JellyfinClient initializer into JellyfinClient.Configuration. Tests were updated to the new signature and doc/comments adjusted; CLAUDE.md's dependency note bumped to ~1.0. No concurrency, player/AVAudioSession, CoreData/SwiftData, auth/entitlement, secrets, or BookPlayerKit-boundary concerns are involved. The Jellyfin token contract (Authorization set after custom headers, token kept out of the URL, injector never overwriting Authorization) is preserved and still covered by the download-request tests. Low risk.

Findings: no findings

_{Model claude-opus-4-8 · run log · 0 new · 0 carried over · 0 resolved · advisory (a human should still review). Duplicate findings are de-duplicated and stale ones auto-resolved across pushes.}