Pin discovery/open to a short schedule-identity snapshot without sharing mutable Jellyfin media sources, gate the authorization-incomplete lab probe behind an explicit opt-in, and add focused plugin tests to the main solution. Redact remote URLs and serialize OpenAPI ApiKey requirements correctly. Refs #357 Co-Authored-By: OpenAI Codex <codex@openai.com>