fix: replace NotImplementedException in ChangePassword, add null guard on stream

[flowcool]

Two small defensive fixes found during a code review (see #1 for the full context).

Changes

1. ChangePassword — replace NotImplementedException with a no-op

IAuthenticationProvider.ChangePassword was throwing NotImplementedException. If Jellyfin ever calls this on an HttpAuth account (e.g. an admin attempting a password reset), it raises an unhandled exception and may crash the calling workflow silently.

Since password management is entirely handled by the reverse proxy in this plugin's model, the correct behaviour is to do nothing and log a message explaining why.

// Before
throw new NotImplementedException();

// After
_logger.LogInformation("ChangePassword is not supported for HttpAuth users — passwords are managed by the reverse proxy.");
return Task.CompletedTask;

2. InjectAuthController.Login — null guard on GetManifestResourceStream

Assembly.GetManifestResourceStream returns null when the embedded resource is not found (namespace mismatch, broken build, etc.). Passing null to File() throws a NullReferenceException. An explicit NotFound() makes the failure visible and diagnosable.

// Before
return File(stream, "text/javascript");

// After
if (stream is null)
    return NotFound();
return File(stream, "text/javascript");

Notes

• No behaviour change for the happy path.
• Both fixes are purely defensive; no new dependencies or configuration.

[UlysseM]

I double checked other implementation, including this official plugin:

https://github.com/jellyfin/jellyfin-plugin-ldapauth/blob/master/LDAP-Auth/LDAPAuthenticationProviderPlugin.cs#L301-L337

clearly seems to be fine with returning exception. There seems to be a benefit in not returning "CompletedTask" back to the client if the task failed, as we wouldn't want the client to think they made a change.

I'm pretty sure that jellyfin would catch and log the exception at a higher level.

Does this actually solve a real issue?

[flowcool]

Fair point — you're right that returning Task.CompletedTask would silently mislead the client into thinking the password was changed. Throwing is the correct behaviour here.

The only thing I'd push back on gently: NotImplementedException conventionally signals "I haven't written this yet", whereas NotSupportedException signals "this is intentionally not supported". Since HttpAuth passwords are always managed by the reverse proxy, NotSupportedException reads more accurately and is what Jellyfin itself uses for unsupported auth operations.

Would you be open to changing just the exception type, keeping a short log so it's diagnosable in traces?

_logger.LogDebug("ChangePassword is not supported for HttpAuth users — passwords are managed by the reverse proxy.");
throw new NotSupportedException("Password changes are not supported for HttpAuth users.");

If you'd rather keep NotImplementedException for consistency with the LDAP plugin, I'm happy to narrow this PR to just that change.

---

Also rebased on main — the null guard in InjectAuthController.cs was already added in your latest commit, so fix #2 is now gone from this PR.