Add post-login welcome and friendly how-it-works guide

backend/app/routers/site.py

@@ -1,4 +1,5 @@
 from typing import Any, Dict
+from urllib.parse import urlsplit
 
 from fastapi import APIRouter, Depends
 
@@ -36,6 +37,13 @@ def _build_site_info(include_changelog: bool) -> Dict[str, Any]:
     }
     if include_changelog:
         info["changelog"] = (CHANGELOG or "").strip()
+        playback_url = (runtime.jellyfin_public_url or "").strip()
+        try:
+            parsed = urlsplit(playback_url)
+            valid = parsed.scheme in {"http", "https"} and bool(parsed.hostname) and not parsed.username and not parsed.password
+        except ValueError:
+            valid = False
+        info["mediaServerUrl"] = playback_url if valid else None
     return info
 
 

backend/tests/test_welcome_site.py

@@ -0,0 +1,19 @@
+import unittest
+from unittest.mock import patch
+from backend.app.config import Settings
+from backend.app.routers.site import _build_site_info
+
+
+class WelcomeSiteTests(unittest.TestCase):
+    def test_public_response_does_not_expose_playback_url(self):
+        with patch('backend.app.routers.site.get_runtime_settings', return_value=Settings().model_copy(update={'jellyfin_public_url': 'https://watch.example.com'})):
+            self.assertNotIn('mediaServerUrl', _build_site_info(False))
+
+    def test_authenticated_response_uses_public_playback_url(self):
+        with patch('backend.app.routers.site.get_runtime_settings', return_value=Settings().model_copy(update={'jellyfin_public_url': 'https://watch.example.com/web/'})):
+            self.assertEqual(_build_site_info(True)['mediaServerUrl'], 'https://watch.example.com/web/')
+
+    def test_missing_unsafe_or_credential_urls_have_no_watch_link(self):
+        for url in ['', 'javascript:alert(1)', '//internal', 'https://user:secret@example.com', 'https://[broken']:
+            with self.subTest(url=url), patch('backend.app.routers.site.get_runtime_settings', return_value=Settings().model_copy(update={'jellyfin_public_url': url})):
+                self.assertIsNone(_build_site_info(True)['mediaServerUrl'])