feat(profiles): show the first linked connection's user picture

A local profile had no picture of its own and always fell back to
initials. It now borrows the user picture of the connection it was
linked to first — oldest Connection.createdAt, ties broken by
connection id, since the join table carries no creation time.

Jellyfin links resolve to /Users/{id}/Images/Primary, keyed by the
PrimaryImageTag now captured at authentication and refreshed from the
/Users/Me body checkHealth already fetches. That endpoint is anonymous
on every Jellyfin release, so the URL carries no api_key and the access
token stays out of the image cache key. Plex links resolve the Home
user the link points at against PlexHomeService's live cache, so no
account-level lookup is needed and the picture tracks Plex's own
refresh.

The picture is derived per snapshot and never written back onto a
Profile: ProfileDetailScreen upserts the model it holds, so a
persisted URL would go stale and outlive the connection it came from.
Plex Home profiles are untouched, including one whose Plex avatar is
unset — it keeps its initials rather than borrowing a lent connection's
picture.

close #1667

test/connection/connection_models_test.dart

@@ -62,6 +62,58 @@ void main() {
       expect(restored.lastAuthenticatedAt, base.lastAuthenticatedAt);
     });
 
+    test('primary image tag round-trips through config JSON', () {
+      final tagged = base.copyWith(primaryImageTag: 'avatar-tag');
+      final restored = JellyfinConnection.fromConfigJson(
+        id: tagged.id,
+        json: tagged.toConfigJson(),
+        status: tagged.status,
+        createdAt: tagged.createdAt,
+        lastAuthenticatedAt: tagged.lastAuthenticatedAt,
+      );
+
+      expect(restored.primaryImageTag, 'avatar-tag');
+    });
+
+    test('config saved before image tags decodes with no primary image tag', () {
+      final legacyJson = <String, Object?>{
+        'baseUrl': base.baseUrl,
+        'baseUrls': base.baseUrls,
+        'serverName': base.serverName,
+        'serverMachineId': base.serverMachineId,
+        'userId': base.userId,
+        'userName': base.userName,
+        'accessToken': base.accessToken,
+        'deviceId': base.deviceId,
+        'isAdministrator': base.isAdministrator,
+      };
+      expect(legacyJson.containsKey('primaryImageTag'), isFalse);
+
+      final restored = JellyfinConnection.fromConfigJson(
+        id: base.id,
+        json: legacyJson,
+        status: base.status,
+        createdAt: base.createdAt,
+        lastAuthenticatedAt: base.lastAuthenticatedAt,
+      );
+
+      expect(restored.primaryImageTag, isNull);
+    });
+
+    test('blank persisted primary image tags decode as null', () {
+      for (final tag in ['', ' \t\n ']) {
+        final restored = JellyfinConnection.fromConfigJson(
+          id: base.id,
+          json: {...base.toConfigJson(), 'primaryImageTag': tag},
+          status: base.status,
+          createdAt: base.createdAt,
+          lastAuthenticatedAt: base.lastAuthenticatedAt,
+        );
+
+        expect(restored.primaryImageTag, isNull, reason: 'tag: "$tag"');
+      }
+    });
+
     test('fromConfigJson with empty payload uses safe defaults (no NPE)', () {
       final restored = JellyfinConnection.fromConfigJson(
         id: 'orphan',
@@ -99,6 +151,32 @@ void main() {
       expect(updated.baseUrls, ['https://jellyfin.lan:8096', 'https://jellyfin.example.com']);
     });
 
+    test('copyWith preserves an existing primary image tag by default', () {
+      final tagged = base.copyWith(primaryImageTag: 'old');
+
+      expect(tagged.copyWith().primaryImageTag, 'old');
+    });
+
+    test('copyWith replaces an existing primary image tag', () {
+      final tagged = base.copyWith(primaryImageTag: 'old');
+
+      expect(tagged.copyWith(primaryImageTag: 'new').primaryImageTag, 'new');
+    });
+
+    test('copyWith only clears a primary image tag through the clear sentinel', () {
+      final tagged = base.copyWith(primaryImageTag: 'old');
+
+      expect(tagged.copyWith(primaryImageTag: null).primaryImageTag, 'old');
+      expect(tagged.copyWith(clearPrimaryImageTag: true).primaryImageTag, isNull);
+    });
+
+    test('reads primary image tags defensively from Jellyfin user DTOs', () {
+      expect(JellyfinConnection.readPrimaryImageTag(const {'PrimaryImageTag': 'avatar-tag'}), 'avatar-tag');
+      expect(JellyfinConnection.readPrimaryImageTag(const {}), isNull);
+      expect(JellyfinConnection.readPrimaryImageTag(const {'PrimaryImageTag': ' \t\n '}), isNull);
+      expect(JellyfinConnection.readPrimaryImageTag(const {'PrimaryImageTag': 42}), '42');
+    });
+
     test('kind and backend match Jellyfin', () {
       expect(base.kind, ConnectionKind.jellyfin);
       expect(base.backend, MediaBackend.jellyfin);