fix(errors): name which Tunarr auth problem it is, not just "check three things"

Closes the last verification gap from the hardening sweep. The real Tunarr here
has auth disabled, so the credential path could only be proven at the header
level. Verified it properly against a local stand-in server that actually
enforces basic auth and returns 401 — no change to the real Tunarr.

Result: correct credentials index normally; absent or wrong ones fail cleanly.
But both landed in the generic "check that tunarr_url is correct and Tunarr is
reachable (and that Tunarr basic auth, if you enabled it, is configured)" —
which asks the user to check three unrelated things when we already know
precisely which one is wrong.

_endpoint_status already tells us it's a 401/403, so:
  - credentials set     -> "Tunarr rejected the username and password (401)."
  - no credentials set  -> "This Tunarr requires a username and password (401),
                            and none are configured."

Two different problems with two different fixes; a user who set no credentials
does not need to be told to re-check the ones they don't have.

Verified against the enforcing stand-in (both messages fire correctly, correct
credentials still index) and re-checked against the real Tunarr for regressions:
still 4100 movies / 401 shows across 4 Plex sources.

348 tests pass.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: AlpineArchitecture

backend/tests/test_media_source_errors.py

@@ -179,3 +179,40 @@ def test_get_tunarr_version_reads_the_tunarr_field(monkeypatch):
 def test_get_tunarr_version_tolerates_junk(monkeypatch):
     monkeypatch.setattr(channel_engine, "api", lambda u, m, p, **k: "not-a-dict")
     assert channel_engine.get_tunarr_version("http://tunarr") is None
+
+
+# ── 401 from Tunarr: say which of the two auth problems it is ─────────────────
+
+def test_401_with_no_credentials_says_to_set_them(monkeypatch):
+    monkeypatch.setattr(channel_engine, "api", lambda *a, **k: None)
+    monkeypatch.setattr(channel_engine, "_endpoint_status", lambda u, p, timeout=10: 401)
+    channel_engine.set_tunarr_auth()
+
+    with pytest.raises(channel_engine.ChannelEngineError) as e:
+        channel_engine.build_library_index("http://tunarr")
+    msg = str(e.value)
+    assert "requires a username and password" in msg
+    assert "none are configured" in msg
+
+
+def test_401_with_credentials_says_they_are_wrong(monkeypatch):
+    """Different advice: they HAVE credentials, so the fix is to correct them."""
+    monkeypatch.setattr(channel_engine, "api", lambda *a, **k: None)
+    monkeypatch.setattr(channel_engine, "_endpoint_status", lambda u, p, timeout=10: 401)
+    channel_engine.set_tunarr_auth("admin", "wrong")
+    try:
+        with pytest.raises(channel_engine.ChannelEngineError) as e:
+            channel_engine.build_library_index("http://tunarr")
+        assert "rejected the username and password" in str(e.value)
+    finally:
+        channel_engine.set_tunarr_auth()
+
+
+def test_403_is_treated_the_same_as_401(monkeypatch):
+    monkeypatch.setattr(channel_engine, "api", lambda *a, **k: None)
+    monkeypatch.setattr(channel_engine, "_endpoint_status", lambda u, p, timeout=10: 403)
+    channel_engine.set_tunarr_auth()
+
+    with pytest.raises(channel_engine.ChannelEngineError) as e:
+        channel_engine.build_library_index("http://tunarr")
+    assert "403" in str(e.value)

channel_engine.py

@@ -182,13 +182,27 @@ def _no_plex_source_error(tunarr_url):
         # Capability detection rather than a version gate: a missing endpoint is
         # the thing that actually breaks us, and it's directly observable —
         # guessing a minimum version number would be less accurate, not more.
-        if _endpoint_status(tunarr_url, "/api/media-sources") == 404:
+        status = _endpoint_status(tunarr_url, "/api/media-sources")
+        if status == 404:
             return ChannelEngineError(
                 "This Tunarr does not have the /api/media-sources endpoint, which "
                 "Programmarr needs to read your libraries. That endpoint arrived in "
                 "Tunarr 1.x, so this server is most likely too old — please update "
                 "Tunarr." + _version_suffix(tunarr_url)
             )
+        if status in (401, 403):
+            # We know exactly what's wrong here, so don't make them check three
+            # things. Distinguish "you set no credentials" from "yours are wrong".
+            if _TUNARR_AUTH:
+                return ChannelEngineError(
+                    f"Tunarr rejected the username and password ({status}). Check "
+                    "tunarr_username / tunarr_password in Settings -> Connections."
+                )
+            return ChannelEngineError(
+                f"This Tunarr requires a username and password ({status}), and none "
+                "are configured. Set tunarr_username / tunarr_password in "
+                "Settings -> Connections."
+            )
         return ChannelEngineError(
             "Could not read media sources from Tunarr — check that tunarr_url is "
             "correct and Tunarr is reachable (and that Tunarr basic auth, if you "