[Feature] Family features: admin PIN, QR approval, managed accounts, time limits #1912

What problem does this solve?

Moonfin already has a per-user sign-in PIN, a Kids Mode with its own PIN, and an admin
editor for access schedules. For a family sharing one TV, some pieces are still missing:

• Nothing nudges an admin to set a PIN, and the PIN is per device and not synced.
• The Quick Connect screen shows a code, but approving it means typing that code on another
  device.
• Setting up every family member on a new TV means signing each one in by hand, and the
  picker shows every user on the server, not just the family using this TV.
• Access schedules are editable but not enforced in the client. A denied login shows a
  generic failure, and there is no "your time is up" experience while using the app.

Proposed solution

Each item is independent and can ship as its own PR. The plugin-backed ones follow the
Moonfin-Client/Plugin proposal and must degrade to today's behavior without it.

1. Server-backed PIN (needs the plugin proposal). Verify against the plugin when
   present, with the current local PIN as the fallback and as the offline cache. A PIN set
   on one device applies on all. The plugin's config page shows which administrators have
   no PIN, so a parent sets it there or in the client's PIN settings.
2. Admin PIN prompt, only without a server-side PIN. When the plugin is absent or
   unusable, offer an administrator "Set PIN / Not now" after sign-in and remember a
   decline. With a server-side PIN available there is no prompt, since the PIN is managed
   through the plugin. Uses the existing PIN dialog and lockout.
3. QR on Quick Connect. Show a QR that opens jellyfin-web's
   …/web/index.html#!/quickconnect?code=<code> so a phone that is already signed in
   approves with one tap. qr_flutter is already a dependency. Hide it when the server
   is Emby or jellyfin-web isn't served at /web/.
4. Managed accounts (needs the plugin proposal). After an admin signs in, the picker shows
   only the users that admin manages, and a "Set up Family Accounts" action in the admin's
   settings (so it's behind the normal sign-in and PIN) signs in the members through
   Quick Connect authorize using the current session. Without the plugin the picker is
   unchanged and the action offers all public users.
5. Time's up. Enforce Jellyfin access schedules in the client: a "Time's up" screen
   with the next allowed time instead of a generic login error, and an in-app block when
   the window ends, including during playback, since Jellyfin rejects the user's requests
   from that moment anyway. The policy is fetched fresh at the gate, and the screen clears
   when access returns. This needs no plugin and uses the device clock.

Kids Mode is a per-device lock and stays as it is. These are per-account features, so
they complement it.

Platform

Android TV, Android

Server

Jellyfin

Alternatives considered

• Reusing Kids Mode for time limits. It's a UI restriction, not a schedule.
• Making the admin PIN mandatory. Left optional, so the no-plugin prompt can be declined.

Additional context

• Plugin proposal: [Feature] Managed accounts and server-side PIN Plugin#328
• I'd start with 3 (small, self-contained) and 5, then the plugin-dependent items.
• I used an AI assistant (Claude) to help research and draft this and will disclose it on
  each PR. I can test on Android TV and Android phone and will say which device. I have no iOS, tvOS, desktop or web target to test, so I'll keep the changes shared and call out anything platform-specific.