Trakt: in-app Settings form for credentials (DB-backed, completes Both)

[detain]

Completes the "Both" approach for configuring Trakt: env-var support shipped in #196, and this adds the in-app Settings form. Builds on detain/phlix-shared#9.

What

• Schema: bumps detain/phlix-shared to v0.7.1, whose server-settings schema adds trakt.client_id / trakt.client_secret / trakt.redirect_uri (group scrobblers). AdminSettingsController::allowedKeys() derives them automatically (15 → 18 keys), so the existing GET/PUT settings API validates + persists them to server_settings with no controller changes.
• Precedence: TraktOAuthController takes an optional SettingsRepository and overlays saved credentials on top of the env/file config — DB-set wins over TRAKT_* env, which wins over the file literal. A blank/unset DB value falls back to env (so it never clobbers a working env config). Wired in Application::getTraktOAuthController().
• UI: new Scrobblers tab in the admin Settings page with Client ID, Client Secret (password field), and Redirect URI inputs, with labels + inline help pointing at trakt.tv/apps.

The form leaves fields blank when only an env value is set (we don't echo env secrets into the form); the runtime env fallback still applies, so Trakt keeps working.

Tests

• TraktOAuthControllerTest: new DB-precedence case (config file with empty creds + DB override ⇒ configured: true and the OAuth flow starts). 9/9.
• AdminSettingsControllerTest: 18-key allow-list.
• SettingsPage.test.tsx: 9-tab assertion incl. Scrobblers.
• phpstan --level=9 + PSR-12 clean; server settings/Trakt unit slice (115) and full admin-ui suite (536) green. Admin bundle rebuilt.

🤖 Generated with Claude Code

[codacy-production]

Not up to standards ⛔

🔴 Issues 4 minor

Alerts:
⚠ 4 issues (≤ 0 issues of at least minor severity)

Results:
4 new issues

Category	Results
CodeStyle	4 minor

View in Codacy

🟢 Metrics 15 complexity · 0 duplication

Metric	Results
Complexity	15
Duplication	0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 55.80%. Comparing base (d9e9ff5) to head (3edfdf2).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files

@@             Coverage Diff              @@
##             master     #197      +/-   ##
============================================
+ Coverage     55.77%   55.80%   +0.03%     
- Complexity    11194    11199       +5     
============================================
  Files           442      442              
  Lines         37681    37693      +12     
============================================
+ Hits          21015    21036      +21     
+ Misses        16666    16657       -9     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3edfdf2b76

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Wire DB credentials into the Trakt plugin

Passing SettingsRepository only to TraktOAuthController makes the new Settings form work for the admin status/connect endpoints, but DB-only credentials still leave the actual scrobbler unconfigured: TraktPlugin::initApi() continues to read only config/scrobblers/trakt.php and never sees server_settings, so when env/file creds are blank it keeps $api null and playback sync/scrobbling silently never runs after using the new in-app form. The same DB-backed credential source needs to be used by the plugin runtime, not just the OAuth controller.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Pass the saved redirect URI to TraktApi

Adding trakt.redirect_uri to the settings overlay makes the UI/API accept a DB redirect URI, but the OAuth requests never use this overlaid value: authorize() computes $redirectUri and then constructs TraktApi with only client id/secret, while TraktApi::getAuthUrl() and exchangeCode() call their own file-based getRedirectUri(). In a DB-only setup, saving a custom redirect URI in the new Scrobblers tab still sends Trakt the default/file URI, so Trakt redirects to the wrong callback or rejects the token exchange for a redirect mismatch.

Useful? React with 👍 / 👎.