fix: authenticate and resolve selected track before playback

[marcosdefina]

What changed

• Put Jellyfin authentication in extraPayload.headers, the field Nitro Player 1.5.0 reads on iOS and Android
• Use the SDK-generated MediaBrowser authorization value instead of a raw token
• Resolve an empty selected-track URL before calling TrackPlayer.play()
• Let overlapping onTracksNeedUpdate requests complete independently instead of globally aborting the earlier iOS request
• Add regressions for native track auth shape, update-before-play ordering, and overlapping URL updates

Why

On Jellify 1.2.7 for iOS, selecting a current Jellyfin item can fetch PlaybackInfo successfully but never issue the subsequent /Audio/{id}/stream request. The Jellyfin session remains paused at 0 ms. A live reproduction generated repeated PlaybackInfo requests but no audio request.

The immediate blocker is that Jellify stores headers at the top level of TrackItem, while Nitro Player explicitly reads extraPayload.headers. The native player therefore receives no usable Jellyfin authorization. The selected queue entry also starts with url: "", and a second lazy-load callback could abort the first selected-track request.

This addresses the first-track/paused-at-zero failure mode reported in #1214.

Validation

• bunx jest jest/functional/ItemToTrack.test.ts jest/functional/Player/queue.test.ts jest/functional/Player/track-media-info.test.ts --runInBand (42 tests pass)
• bun run tsc
• Focused ESLint passes
• Full unsigned iOS Debug build succeeds with Xcode 26.0.1