fix(train): Jellyfin over https alone, but on the phone itself (ADR 0030, D54)

An http address to another machine is refused as typed, saying why: over it the password, the token and what the person listens to went through the network in clear, and the music job, held by Android to https, retried for ever without a track. A Jellyfin on the phone (localhost, 127.0.0.1) stays reachable over http, the network security config allowing those two alone.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

apps/train/halkyon_train_flutter/test/feature/music/jellyfin_client_test.dart

@@ -51,6 +51,18 @@ void main() {
       expect(jellyfinAddress('ftp://music.example.org'), isNull);
       expect(jellyfinAddress('https://'), isNull);
     });
+
+    test('in clear is http to anywhere but this phone itself (D47)', () {
+      bool inClear(String typed) => jellyfinInClear(jellyfinAddress(typed)!);
+      expect(inClear('http://192.168.1.4:8096'), isTrue);
+      expect(inClear('http://music.example.org'), isTrue);
+      expect(inClear('http://127.0.0.2:8096'), isTrue);
+      expect(inClear('https://192.168.1.4:8920'), isFalse);
+      expect(inClear('music.example.org'), isFalse);
+      expect(inClear('http://localhost:8096'), isFalse);
+      expect(inClear('http://LocalHost:8096'), isFalse);
+      expect(inClear('http://127.0.0.1:8096'), isFalse);
+    });
   });
 
   test('a server says its name and whether Quick Connect is on', () async {

apps/train/halkyon_train_flutter/test/feature/music/music_screen_test.dart

@@ -192,6 +192,20 @@ void main() {
     expect(jellyfin.requests, isEmpty);
   });
 
+  testWidgets('an address in clear is refused, and nothing is asked', (
+    tester,
+  ) async {
+    final jellyfin = FakeJellyfin();
+    await show(tester, jellyfin);
+
+    await tester.enterText(find.byType(TextField), 'http://192.168.1.4:8096');
+    await tester.tap(find.text('Connect'));
+    await tester.pump();
+
+    expect(find.textContaining('https'), findsOneWidget);
+    expect(jellyfin.requests, isEmpty);
+  });
+
   testWidgets('a code not approved in time expires, and a new one is asked '
       'for', (tester) async {
     final jellyfin = FakeJellyfin();