fix(login): warn instead of swallowing account-save errors

On first login with "save account" checked, the intro sheet's 1s timer
fired while the post-login save-account bottom sheet was still up and
stole its presentation (both are gorhom modals), closing it. Gate the
intro on pendingAccountSaveAtom so it only schedules once no account
save is pending: before the sheet opens, or after it is dismissed.

app/(auth)/(tabs)/(home)/settings/plugins/jellyseerr/page.tsx

@@ -1,8 +1,11 @@
-import { ScrollView, View } from "react-native";
+import { ScrollView } from "react-native";
 import { useSafeAreaInsets } from "react-native-safe-area-context";
+import DisabledSetting from "@/components/settings/DisabledSetting";
 import { JellyseerrSettings } from "@/components/settings/Jellyseerr";
+import { useSettings } from "@/utils/atoms/settings";
 
 export default function JellyseerrPluginPage() {
+  const { pluginSettings } = useSettings();
   const insets = useSafeAreaInsets();
 
   return (
@@ -13,9 +16,12 @@ export default function JellyseerrPluginPage() {
         paddingRight: insets.right,
       }}
     >
-      <View className='p-4'>
+      <DisabledSetting
+        disabled={pluginSettings?.jellyseerrServerUrl?.locked === true}
+        className='p-4'
+      >
         <JellyseerrSettings />
-      </View>
+      </DisabledSetting>
     </ScrollView>
   );
 }

app/(auth)/(tabs)/(home)/settings/plugins/kefinTweaks/page.tsx

@@ -1,8 +1,11 @@
-import { ScrollView, View } from "react-native";
+import { ScrollView } from "react-native";
 import { useSafeAreaInsets } from "react-native-safe-area-context";
+import DisabledSetting from "@/components/settings/DisabledSetting";
 import { KefinTweaksSettings } from "@/components/settings/KefinTweaks";
+import { useSettings } from "@/utils/atoms/settings";
 
 export default function KefinTweaksPage() {
+  const { pluginSettings } = useSettings();
   const insets = useSafeAreaInsets();
 
   return (
@@ -13,9 +16,12 @@ export default function KefinTweaksPage() {
         paddingRight: insets.right,
       }}
     >
-      <View className='px-4'>
+      <DisabledSetting
+        disabled={pluginSettings?.useKefinTweaks?.locked === true}
+        className='p-4'
+      >
         <KefinTweaksSettings />
-      </View>
+      </DisabledSetting>
     </ScrollView>
   );
 }

app/(auth)/(tabs)/(home)/settings/plugins/marlin-search/page.tsx

@@ -1,5 +1,5 @@
 import { useNavigation } from "expo-router";
-import { useEffect, useState } from "react";
+import { useEffect, useMemo, useState } from "react";
 import { useTranslation } from "react-i18next";
 import {
   Linking,
@@ -14,22 +14,22 @@ import { toast } from "sonner-native";
 import { Text } from "@/components/common/Text";
 import { ListGroup } from "@/components/list/ListGroup";
 import { ListItem } from "@/components/list/ListItem";
+import DisabledSetting from "@/components/settings/DisabledSetting";
 import { useNetworkAwareQueryClient } from "@/hooks/useNetworkAwareQueryClient";
 import { useSettings } from "@/utils/atoms/settings";
 
 export default function MarlinSearchPage() {
   const navigation = useNavigation();
+
   const { t } = useTranslation();
+
   const insets = useSafeAreaInsets();
+
   const { settings, updateSettings, pluginSettings } = useSettings();
   const queryClient = useNetworkAwareQueryClient();
 
   const [value, setValue] = useState<string>(settings?.marlinServerUrl || "");
 
-  const searchEngineLocked = pluginSettings?.searchEngine?.locked === true;
-  const marlinUrlLocked = pluginSettings?.marlinServerUrl?.locked === true;
-  const hasStreamystats = !!pluginSettings?.streamyStatsServerUrl?.value;
-
   const onSave = (val: string) => {
     updateSettings({
       marlinServerUrl: !val.endsWith("/") ? val : val.slice(0, -1),
@@ -41,8 +41,15 @@ export default function MarlinSearchPage() {
     Linking.openURL("https://github.com/fredrikburmester/marlin-search");
   };
 
+  const disabled = useMemo(() => {
+    return (
+      pluginSettings?.searchEngine?.locked === true &&
+      pluginSettings?.marlinServerUrl?.locked === true
+    );
+  }, [pluginSettings]);
+
   useEffect(() => {
-    if (!marlinUrlLocked) {
+    if (!pluginSettings?.marlinServerUrl?.locked) {
       navigation.setOptions({
         headerRight: () => (
           <TouchableOpacity onPress={() => onSave(value)} className='px-2'>
@@ -53,7 +60,7 @@ export default function MarlinSearchPage() {
         ),
       });
     }
-  }, [navigation, value, marlinUrlLocked, t]);
+  }, [navigation, value, pluginSettings?.marlinServerUrl?.locked, t]);
 
   if (!settings) return null;
 
@@ -65,15 +72,19 @@ export default function MarlinSearchPage() {
         paddingRight: insets.right,
       }}
     >
-      <View className='px-4'>
+      <DisabledSetting disabled={disabled} className='px-4'>
         <ListGroup>
-          {/* disabledByAdmin renders the "Disabled by admin" notice as the row's
-              subtitle (same pattern as the Streamystats settings) — no clipping. */}
+          <DisabledSetting
+            disabled={
+              pluginSettings?.searchEngine?.locked === true ||
+              !!pluginSettings?.streamyStatsServerUrl?.value
+            }
+            showText={!pluginSettings?.marlinServerUrl?.locked}
+          >
             <ListItem
               title={t(
                 "home.settings.plugins.marlin_search.enable_marlin_search",
               )}
-            disabledByAdmin={searchEngineLocked}
               onPress={() => {
                 updateSettings({ searchEngine: "Jellyfin" });
                 queryClient.invalidateQueries({ queryKey: ["search"] });
@@ -81,23 +92,32 @@ export default function MarlinSearchPage() {
             >
               <Switch
                 value={settings.searchEngine === "Marlin"}
-              disabled={searchEngineLocked || hasStreamystats}
-              onValueChange={(val) => {
-                updateSettings({ searchEngine: val ? "Marlin" : "Jellyfin" });
+                disabled={!!pluginSettings?.streamyStatsServerUrl?.value}
+                onValueChange={(value) => {
+                  updateSettings({
+                    searchEngine: value ? "Marlin" : "Jellyfin",
+                  });
                   queryClient.invalidateQueries({ queryKey: ["search"] });
                 }}
               />
             </ListItem>
+          </DisabledSetting>
         </ListGroup>
 
-        <ListGroup className='mt-2'>
-          <ListItem
-            title={t("home.settings.plugins.marlin_search.url")}
-            disabledByAdmin={marlinUrlLocked}
+        <DisabledSetting
+          disabled={pluginSettings?.marlinServerUrl?.locked === true}
+          showText={!pluginSettings?.searchEngine?.locked}
+          className='mt-2 flex flex-col rounded-xl overflow-hidden pl-4 bg-neutral-900 px-4'
         >
+          <View
+            className={"flex flex-row items-center bg-neutral-900 h-11 pr-4"}
+          >
+            <Text className='mr-4'>
+              {t("home.settings.plugins.marlin_search.url")}
+            </Text>
             <TextInput
-              editable={!marlinUrlLocked && settings.searchEngine === "Marlin"}
-              className='text-white text-right flex-1'
+              editable={settings.searchEngine === "Marlin"}
+              className='text-white'
               placeholder={t(
                 "home.settings.plugins.marlin_search.server_url_placeholder",
               )}
@@ -108,16 +128,15 @@ export default function MarlinSearchPage() {
               textContentType='URL'
               onChangeText={(text) => setValue(text)}
             />
-          </ListItem>
-        </ListGroup>
-
+          </View>
+        </DisabledSetting>
         <Text className='px-4 text-xs text-neutral-500 mt-1'>
           {t("home.settings.plugins.marlin_search.marlin_search_hint")}{" "}
           <Text className='text-blue-500' onPress={handleOpenLink}>
             {t("home.settings.plugins.marlin_search.read_more_about_marlin")}
           </Text>
         </Text>
-      </View>
+      </DisabledSetting>
     </ScrollView>
   );
 }

app/(auth)/(tabs)/(home)/settings/plugins/page.tsx

@@ -1,21 +1,9 @@
-import { useCallback } from "react";
-import { useTranslation } from "react-i18next";
-import { Platform, ScrollView, TouchableOpacity, View } from "react-native";
+import { Platform, ScrollView, View } from "react-native";
 import { useSafeAreaInsets } from "react-native-safe-area-context";
-import { toast } from "sonner-native";
-import { Text } from "@/components/common/Text";
 import { PluginSettings } from "@/components/settings/PluginSettings";
-import { useSettings } from "@/utils/atoms/settings";
 
 export default function PluginsPage() {
   const insets = useSafeAreaInsets();
-  const { t } = useTranslation();
-  const { refreshStreamyfinPluginSettings } = useSettings();
-
-  const handleRefreshFromServer = useCallback(async () => {
-    await refreshStreamyfinPluginSettings();
-    toast.success(t("home.settings.plugins.streamystats.toasts.refreshed"));
-  }, [refreshStreamyfinPluginSettings, t]);
 
   return (
     <ScrollView
@@ -30,17 +18,6 @@ export default function PluginsPage() {
         style={{ paddingTop: Platform.OS === "android" ? 10 : 0 }}
       >
         <PluginSettings />
-
-        {/* Pulls the centralised Streamyfin plugin settings for every plugin,
-            so it lives on the plugins index rather than inside Streamystats. */}
-        <TouchableOpacity
-          onPress={handleRefreshFromServer}
-          className='py-3 rounded-xl bg-neutral-800'
-        >
-          <Text className='text-center text-blue-500'>
-            {t("home.settings.plugins.streamystats.refresh_from_server")}
-          </Text>
-        </TouchableOpacity>
       </View>
     </ScrollView>
   );

app/(auth)/(tabs)/(home)/settings/plugins/streamystats/page.tsx

@@ -22,7 +22,12 @@ export default function StreamystatsPage() {
   const navigation = useNavigation();
   const insets = useSafeAreaInsets();
 
-  const { settings, updateSettings, pluginSettings } = useSettings();
+  const {
+    settings,
+    updateSettings,
+    pluginSettings,
+    refreshStreamyfinPluginSettings,
+  } = useSettings();
   const queryClient = useNetworkAwareQueryClient();
 
   // Local state for all editable fields
@@ -44,21 +49,7 @@ export default function StreamystatsPage() {
   );
 
   const isUrlLocked = pluginSettings?.streamyStatsServerUrl?.locked === true;
-  const searchLocked = pluginSettings?.searchEngine?.locked === true;
-  const movieRecsLocked =
-    pluginSettings?.streamyStatsMovieRecommendations?.locked === true;
-  const seriesRecsLocked =
-    pluginSettings?.streamyStatsSeriesRecommendations?.locked === true;
-  const promotedWatchlistsLocked =
-    pluginSettings?.streamyStatsPromotedWatchlists?.locked === true;
-  const hideWatchlistsTabLocked =
-    pluginSettings?.hideWatchlistsTab?.locked === true;
-  // The input renders the locked admin URL; enablement must follow the same
-  // effective value or every toggle stays disabled until local state syncs.
-  const effectiveUrl = isUrlLocked
-    ? (settings?.streamyStatsServerUrl ?? "")
-    : url;
-  const isStreamystatsEnabled = !!effectiveUrl;
+  const isStreamystatsEnabled = !!url;
 
   const onSave = useCallback(() => {
     const cleanUrl = url.endsWith("/") ? url.slice(0, -1) : url;
@@ -122,6 +113,17 @@ export default function StreamystatsPage() {
     Linking.openURL("https://github.com/fredrikburmester/streamystats");
   };
 
+  const handleRefreshFromServer = useCallback(async () => {
+    const newPluginSettings = await refreshStreamyfinPluginSettings();
+    // Update local state with new values
+    const newUrl = newPluginSettings?.streamyStatsServerUrl?.value || "";
+    setUrl(newUrl);
+    if (newUrl) {
+      setUseForSearch(true);
+    }
+    toast.success(t("home.settings.plugins.streamystats.toasts.refreshed"));
+  }, [refreshStreamyfinPluginSettings, t]);
+
   if (!settings) return null;
 
   return (
@@ -144,7 +146,7 @@ export default function StreamystatsPage() {
               placeholder={t(
                 "home.settings.plugins.streamystats.server_url_placeholder",
               )}
-              value={effectiveUrl}
+              value={url}
               keyboardType='url'
               returnKeyType='done'
               autoCapitalize='none'
@@ -169,18 +171,11 @@ export default function StreamystatsPage() {
         >
           <ListItem
             title={t("home.settings.plugins.streamystats.enable_search")}
-            disabledByAdmin={searchLocked}
+            disabledByAdmin={pluginSettings?.searchEngine?.locked === true}
           >
-            {/* Locked controls show the live admin value and can't be toggled —
-                local form state would let the switch flip while the write guard
-                drops the change. */}
             <Switch
-              value={
-                searchLocked
-                  ? settings?.searchEngine === "Streamystats"
-                  : useForSearch
-              }
-              disabled={!isStreamystatsEnabled || searchLocked}
+              value={useForSearch}
+              disabled={!isStreamystatsEnabled}
               onValueChange={setUseForSearch}
             />
           </ListItem>
@@ -188,62 +183,52 @@ export default function StreamystatsPage() {
             title={t(
               "home.settings.plugins.streamystats.enable_movie_recommendations",
             )}
-            disabledByAdmin={movieRecsLocked}
+            disabledByAdmin={
+              pluginSettings?.streamyStatsMovieRecommendations?.locked === true
+            }
           >
             <Switch
-              value={
-                movieRecsLocked
-                  ? (settings?.streamyStatsMovieRecommendations ?? false)
-                  : movieRecs
-              }
+              value={movieRecs}
               onValueChange={setMovieRecs}
-              disabled={!isStreamystatsEnabled || movieRecsLocked}
+              disabled={!isStreamystatsEnabled}
             />
           </ListItem>
           <ListItem
             title={t(
               "home.settings.plugins.streamystats.enable_series_recommendations",
             )}
-            disabledByAdmin={seriesRecsLocked}
+            disabledByAdmin={
+              pluginSettings?.streamyStatsSeriesRecommendations?.locked === true
+            }
           >
             <Switch
-              value={
-                seriesRecsLocked
-                  ? (settings?.streamyStatsSeriesRecommendations ?? false)
-                  : seriesRecs
-              }
+              value={seriesRecs}
               onValueChange={setSeriesRecs}
-              disabled={!isStreamystatsEnabled || seriesRecsLocked}
+              disabled={!isStreamystatsEnabled}
             />
           </ListItem>
           <ListItem
             title={t(
               "home.settings.plugins.streamystats.enable_promoted_watchlists",
             )}
-            disabledByAdmin={promotedWatchlistsLocked}
+            disabledByAdmin={
+              pluginSettings?.streamyStatsPromotedWatchlists?.locked === true
+            }
           >
             <Switch
-              value={
-                promotedWatchlistsLocked
-                  ? (settings?.streamyStatsPromotedWatchlists ?? false)
-                  : promotedWatchlists
-              }
+              value={promotedWatchlists}
               onValueChange={setPromotedWatchlists}
-              disabled={!isStreamystatsEnabled || promotedWatchlistsLocked}
+              disabled={!isStreamystatsEnabled}
             />
           </ListItem>
           <ListItem
             title={t("home.settings.plugins.streamystats.hide_watchlists_tab")}
-            disabledByAdmin={hideWatchlistsTabLocked}
+            disabledByAdmin={pluginSettings?.hideWatchlistsTab?.locked === true}
           >
             <Switch
-              value={
-                hideWatchlistsTabLocked
-                  ? (settings?.hideWatchlistsTab ?? false)
-                  : hideWatchlistsTab
-              }
+              value={hideWatchlistsTab}
               onValueChange={setHideWatchlistsTab}
-              disabled={!isStreamystatsEnabled || hideWatchlistsTabLocked}
+              disabled={!isStreamystatsEnabled}
             />
           </ListItem>
         </ListGroup>
@@ -251,6 +236,15 @@ export default function StreamystatsPage() {
           {t("home.settings.plugins.streamystats.home_sections_hint")}
         </Text>
 
+        <TouchableOpacity
+          onPress={handleRefreshFromServer}
+          className='mt-6 py-3 rounded-xl bg-neutral-800'
+        >
+          <Text className='text-center text-blue-500'>
+            {t("home.settings.plugins.streamystats.refresh_from_server")}
+          </Text>
+        </TouchableOpacity>
+
         {/* Disable button - only show if URL is not locked and Streamystats is enabled */}
         {!isUrlLocked && isStreamystatsEnabled && (
           <TouchableOpacity

app/_layout.tsx

@@ -11,6 +11,7 @@ import { Image } from "expo-image";
 import { DarkTheme, ThemeProvider } from "expo-router/react-navigation";
 import { Platform } from "react-native";
 import { GlobalModal } from "@/components/GlobalModal";
+import { PendingAccountSaveModal } from "@/components/PendingAccountSaveModal";
 import { enableTVMenuKeyInterception } from "@/hooks/useTVBackHandler";
 import i18n from "@/i18n";
 import { DownloadProvider } from "@/providers/DownloadProvider";
@@ -547,6 +548,7 @@ function Layout() {
                                   closeButton
                                 />
                                 {!Platform.isTV && <GlobalModal />}
+                                {!Platform.isTV && <PendingAccountSaveModal />}
                               </ThemeProvider>
                             </IntroSheetProvider>
                           </BottomSheetModalProvider>

components/PendingAccountSaveModal.tsx

@@ -0,0 +1,45 @@
+import { useAtom, useAtomValue } from "jotai";
+import type React from "react";
+import { useEffect } from "react";
+import { Platform } from "react-native";
+import { SaveAccountModal } from "@/components/SaveAccountModal";
+import {
+  pendingAccountSaveAtom,
+  useJellyfin,
+  userAtom,
+} from "@/providers/JellyfinProvider";
+
+/**
+ * Post-login save-account prompt. Login flows (password or Quick Connect)
+ * only flag the intent via pendingAccountSaveAtom; the protection picker
+ * shows here, AFTER the session is authorized — the login screen itself
+ * unmounts as soon as the user is set, so it can't host the modal.
+ */
+export const PendingAccountSaveModal: React.FC = () => {
+  const [pending, setPending] = useAtom(pendingAccountSaveAtom);
+  const user = useAtomValue(userAtom);
+  const { saveCurrentAccount } = useJellyfin();
+
+  // A logout before answering drops the intent — it must not resurface on
+  // the next (possibly different) login.
+  useEffect(() => {
+    if (!user && pending) setPending(null);
+  }, [user, pending, setPending]);
+
+  if (Platform.isTV) return null;
+
+  return (
+    <SaveAccountModal
+      visible={!!pending && !!user}
+      username={user?.Name ?? ""}
+      onClose={() => setPending(null)}
+      onSave={(securityType, pinCode) => {
+        const serverName = pending?.serverName;
+        setPending(null);
+        saveCurrentAccount({ securityType, pinCode, serverName }).catch(
+          (error) => console.warn("Failed to save account:", error),
+        );
+      }}
+    />
+  );
+};

components/home/Home.tsx

@@ -39,7 +39,11 @@ import { useRefreshLibraryOnFocus } from "@/hooks/useRefreshLibraryOnFocus";
 import { useInvalidatePlaybackProgressCache } from "@/hooks/useRevalidatePlaybackProgressCache";
 import { useDownload } from "@/providers/DownloadProvider";
 import { useIntroSheet } from "@/providers/IntroSheetProvider";
-import { apiAtom, userAtom } from "@/providers/JellyfinProvider";
+import {
+  apiAtom,
+  pendingAccountSaveAtom,
+  userAtom,
+} from "@/providers/JellyfinProvider";
 import { SortByOption, SortOrderOption } from "@/utils/atoms/filters";
 import { useSettings } from "@/utils/atoms/settings";
 import { eventBus } from "@/utils/eventBus";
@@ -89,6 +93,9 @@ const HomeMobile = () => {
   const invalidateCache = useInvalidatePlaybackProgressCache();
   const [loadedSections, setLoadedSections] = useState<Set<string>>(new Set());
   const { showIntro } = useIntroSheet();
+  // Gate the intro so it can't steal presentation from the post-login
+  // save-account sheet (both are BottomSheetModals): wait until no save is pending.
+  const pendingAccountSave = useAtomValue(pendingAccountSaveAtom);
 
   // Fallback refresh for newly added content when returning to the home screen
   // (primary path is the LibraryChanged WebSocket event).
@@ -97,7 +104,9 @@ const HomeMobile = () => {
   // Show intro modal on first launch
   useEffect(() => {
     const hasShownIntro = storage.getBoolean("hasShownIntro");
-    if (!hasShownIntro) {
+    // Defer while the save-account sheet is up; this effect re-runs and schedules
+    // the intro once the sheet is dismissed (pendingAccountSaveAtom cleared).
+    if (!hasShownIntro && !pendingAccountSave) {
       const timer = setTimeout(() => {
         showIntro();
       }, 1000);
@@ -106,7 +115,7 @@ const HomeMobile = () => {
         clearTimeout(timer);
       };
     }
-  }, [showIntro]);
+  }, [showIntro, pendingAccountSave]);
 
   useEffect(() => {
     if (isConnected && !prevIsConnected.current) {

components/login/Login.tsx

@@ -3,7 +3,7 @@ import type { PublicSystemInfo } from "@jellyfin/sdk/lib/generated-client";
 import { Image } from "expo-image";
 import { useLocalSearchParams, useNavigation } from "expo-router";
 import { t } from "i18next";
-import { useAtomValue } from "jotai";
+import { useAtomValue, useSetAtom } from "jotai";
 import { useCallback, useEffect, useState } from "react";
 import {
   Alert,
@@ -21,13 +21,14 @@ import { Input } from "@/components/common/Input";
 import { Text } from "@/components/common/Text";
 import JellyfinServerDiscovery from "@/components/JellyfinServerDiscovery";
 import { PreviousServersList } from "@/components/PreviousServersList";
-import { SaveAccountModal } from "@/components/SaveAccountModal";
 import { Colors } from "@/constants/Colors";
-import { apiAtom, useJellyfin } from "@/providers/JellyfinProvider";
-import type {
-  AccountSecurityType,
-  SavedServer,
-} from "@/utils/secureCredentials";
+import {
+  apiAtom,
+  pendingAccountSaveAtom,
+  useJellyfin,
+  userAtom,
+} from "@/providers/JellyfinProvider";
+import type { SavedServer } from "@/utils/secureCredentials";
 
 const CredentialsSchema = z.object({
   username: z.string().min(1, t("login.username_required")),
@@ -35,6 +36,7 @@ const CredentialsSchema = z.object({
 
 export const Login: React.FC = () => {
   const api = useAtomValue(apiAtom);
+  const user = useAtomValue(userAtom);
   const navigation = useNavigation();
   const params = useLocalSearchParams();
   const {
@@ -45,6 +47,7 @@ export const Login: React.FC = () => {
     loginWithSavedCredential,
     loginWithPassword,
   } = useJellyfin();
+  const setPendingAccountSave = useSetAtom(pendingAccountSaveAtom);
 
   const {
     apiUrl: _apiUrl,
@@ -64,13 +67,24 @@ export const Login: React.FC = () => {
     password: _password || "",
   });
 
-  // Save account state
+  // Save account state — only the intent lives here; the protection picker is
+  // the global PendingAccountSaveModal, shown after the login succeeds.
   const [saveAccount, setSaveAccount] = useState(false);
-  const [showSaveModal, setShowSaveModal] = useState(false);
-  const [pendingLogin, setPendingLogin] = useState<{
-    username: string;
-    password: string;
-  } | null>(null);
+
+  // Tracks an in-flight Quick Connect attempt (code issued, provider polling).
+  const [quickConnectActive, setQuickConnectActive] = useState(false);
+
+  // A Quick Connect login with "save account" on flags the post-login save:
+  // the protection picker shows globally once the session exists (this screen
+  // unmounts on login, so it can't host the modal).
+  useEffect(() => {
+    if (user) {
+      if (quickConnectActive && saveAccount) {
+        setPendingAccountSave({ serverName });
+      }
+      setQuickConnectActive(false);
+    }
+  }, [user]);
 
   // Handle URL params for server connection
   useEffect(() => {
@@ -117,29 +131,22 @@ export const Login: React.FC = () => {
     const result = CredentialsSchema.safeParse(credentials);
     if (!result.success) return;
 
-    if (saveAccount) {
-      setPendingLogin({
-        username: credentials.username,
-        password: credentials.password,
-      });
-      setShowSaveModal(true);
-    } else {
-      await performLogin(credentials.username, credentials.password);
+    const ok = await performLogin(credentials.username, credentials.password);
+    // The protection picker shows AFTER a successful login (global modal) —
+    // never for a failed one.
+    if (ok && saveAccount) {
+      setPendingAccountSave({ serverName });
     }
   };
 
   const performLogin = async (
     username: string,
     password: string,
-    options?: {
-      saveAccount?: boolean;
-      securityType?: AccountSecurityType;
-      pinCode?: string;
-    },
-  ) => {
+  ): Promise<boolean> => {
     setLoading(true);
     try {
-      await login(username, password, serverName, options);
+      await login(username, password, serverName);
+      return true;
     } catch (error) {
       if (error instanceof Error) {
         Alert.alert(t("login.connection_failed"), error.message);
@@ -149,23 +156,9 @@ export const Login: React.FC = () => {
           t("login.an_unexpected_error_occured"),
         );
       }
+      return false;
     } finally {
       setLoading(false);
-      setPendingLogin(null);
-    }
-  };
-
-  const handleSaveAccountConfirm = async (
-    securityType: AccountSecurityType,
-    pinCode?: string,
-  ) => {
-    setShowSaveModal(false);
-    if (pendingLogin) {
-      await performLogin(pendingLogin.username, pendingLogin.password, {
-        saveAccount: true,
-        securityType,
-        pinCode,
-      });
     }
   };
 
@@ -259,6 +252,7 @@ export const Login: React.FC = () => {
     try {
       const code = await initiateQuickConnect();
       if (code) {
+        setQuickConnectActive(true);
         Alert.alert(
           t("login.quick_connect"),
           t("login.enter_code_to_login", { code: code }),
@@ -443,16 +437,6 @@ export const Login: React.FC = () => {
           </View>
         )}
       </KeyboardAvoidingView>
-
-      <SaveAccountModal
-        visible={showSaveModal}
-        onClose={() => {
-          setShowSaveModal(false);
-          setPendingLogin(null);
-        }}
-        onSave={handleSaveAccountConfirm}
-        username={pendingLogin?.username || credentials.username}
-      />
     </SafeAreaView>
   );
 };

components/settings/Jellyseerr.tsx

@@ -20,10 +20,7 @@ export const JellyseerrSettings = () => {
   const { t } = useTranslation();
 
   const [user] = useAtom(userAtom);
-  const { settings, updateSettings, pluginSettings } = useSettings();
-  // Only the server URL is admin-lockable — the password stays editable so
-  // the user can still sign in to the admin-pinned Jellyseerr server.
-  const urlLocked = pluginSettings?.jellyseerrServerUrl?.locked === true;
+  const { settings, updateSettings } = useSettings();
 
   const [jellyseerrPassword, setJellyseerrPassword] = useState<
     string | undefined
@@ -118,7 +115,6 @@ export const JellyseerrSettings = () => {
           </>
         ) : (
           <View className='flex flex-col rounded-xl overflow-hidden p-4 bg-neutral-900'>
-            <View style={{ opacity: urlLocked ? 0.5 : 1 }}>
             <Text className='font-bold mb-1'>
               {t("home.settings.plugins.jellyseerr.server_url")}
             </Text>
@@ -132,11 +128,7 @@ export const JellyseerrSettings = () => {
               placeholder={t(
                 "home.settings.plugins.jellyseerr.server_url_placeholder",
               )}
-                value={
-                  urlLocked
-                    ? settings?.jellyseerrServerUrl
-                    : (jellyseerrServerUrl ?? settings?.jellyseerrServerUrl)
-                }
+              value={jellyseerrServerUrl ?? settings?.jellyseerrServerUrl}
               defaultValue={
                 settings?.jellyseerrServerUrl ?? jellyseerrServerUrl
               }
@@ -145,14 +137,8 @@ export const JellyseerrSettings = () => {
               autoCapitalize='none'
               textContentType='URL'
               onChangeText={setjellyseerrServerUrl}
-                editable={!urlLocked && !loginToJellyseerrMutation.isPending}
+              editable={!loginToJellyseerrMutation.isPending}
             />
-              {urlLocked && (
-                <Text className='text-xs text-red-600 mb-2'>
-                  Disabled by admin
-                </Text>
-              )}
-            </View>
             <View>
               <Text className='font-bold mb-2'>
                 {t("home.settings.plugins.jellyseerr.password")}

components/settings/KefinTweaks.tsx

@@ -1,28 +1,33 @@
 import { useTranslation } from "react-i18next";
-import { Switch } from "react-native";
+import { Switch, Text, View } from "react-native";
 import { useSettings } from "@/utils/atoms/settings";
-import { ListGroup } from "../list/ListGroup";
-import { ListItem } from "../list/ListItem";
 
 export const KefinTweaksSettings = () => {
-  const { settings, updateSettings, pluginSettings } = useSettings();
+  const { settings, updateSettings } = useSettings();
   const { t } = useTranslation();
 
   const isEnabled = settings?.useKefinTweaks ?? false;
-  const locked = pluginSettings?.useKefinTweaks?.locked === true;
 
   return (
-    <ListGroup>
-      <ListItem
-        title={t("home.settings.plugins.kefinTweaks.watchlist_enabler")}
-        disabledByAdmin={locked}
-      >
+    <View className=''>
+      <View className='flex flex-col rounded-xl overflow-hidden p-4 bg-neutral-900'>
+        <Text className='text-xs text-red-600 mb-2'>
+          {t("home.settings.plugins.kefinTweaks.watchlist_enabler")}
+        </Text>
+
+        <View className='flex flex-row items-center justify-between mt-2'>
+          <Text className='text-white'>
+            {isEnabled ? t("Watchlist On") : t("Watchlist Off")}
+          </Text>
+
           <Switch
             value={isEnabled}
-          disabled={locked}
             onValueChange={(value) => updateSettings({ useKefinTweaks: value })}
+            trackColor={{ false: "#555", true: "purple" }}
+            thumbColor={isEnabled ? "#fff" : "#ccc"}
           />
-      </ListItem>
-    </ListGroup>
+        </View>
+      </View>
+    </View>
   );
 };

components/settings/PluginSettings.tsx

@@ -20,12 +20,7 @@ export const PluginSettings = () => {
     >
       <ListItem
         onPress={() => router.push("/settings/plugins/jellyseerr/page")}
-        title='Jellyseerr'
-        showArrow
-      />
-      <ListItem
-        onPress={() => router.push("/settings/plugins/streamystats/page")}
-        title='Streamystats'
+        title={"Jellyseerr"}
         showArrow
       />
       <ListItem
@@ -33,6 +28,11 @@ export const PluginSettings = () => {
         title='Marlin Search'
         showArrow
       />
+      <ListItem
+        onPress={() => router.push("/settings/plugins/streamystats/page")}
+        title='Streamystats'
+        showArrow
+      />
       <ListItem
         onPress={() => router.push("/settings/plugins/kefinTweaks/page")}
         title='KefinTweaks'

providers/JellyfinProvider.tsx

@@ -15,6 +15,7 @@ import {
   useContext,
   useEffect,
   useMemo,
+  useRef,
   useState,
 } from "react";
 import { useTranslation } from "react-i18next";
@@ -91,6 +92,12 @@ export const apiAtom = atom<Api | null>(initialApi);
 export const userAtom = atom<UserDto | null>(initialUser);
 export const wsAtom = atom<WebSocket | null>(null);
 export const cacheVersionAtom = atom<number>(0);
+// Set by a login flow that wants the account saved: the protection picker
+// shows AFTER the session is authorized (the login screen unmounts on
+// success, so the modal lives at the root — see PendingAccountSaveModal).
+export const pendingAccountSaveAtom = atom<{ serverName?: string } | null>(
+  null,
+);
 
 interface LoginOptions {
   saveAccount?: boolean;
@@ -108,6 +115,11 @@ interface JellyfinContextValue {
     serverName?: string,
     options?: LoginOptions,
   ) => Promise<void>;
+  saveCurrentAccount: (options?: {
+    securityType?: AccountSecurityType;
+    pinCode?: string;
+    serverName?: string;
+  }) => Promise<void>;
   logout: () => Promise<void>;
   initiateQuickConnect: () => Promise<string | undefined>;
   stopQuickConnectPolling: () => void;
@@ -165,6 +177,46 @@ export const JellyfinProvider: React.FC<{ children: ReactNode }> = ({
   const { clearAllJellyseerData, setJellyseerrUser } = useJellyseerr();
   const queryClient = useQueryClient();
 
+  // --- Session-expiry handling ----------------------------------------------
+  // When the server revokes the token (e.g. the device/session is deleted), a
+  // 401 can surface from any authenticated request. Without central handling
+  // the dead token stays in storage, so every reload re-fires authed calls →
+  // 401 spam + uncaught rejections, and the app lingers in a half-authenticated
+  // state. A single response interceptor on the authenticated api clears the
+  // session on the first 401 so the app drops cleanly to the login screen.
+  const sessionExpiredRef = useRef(false);
+
+  const handleSessionExpired = useCallback(() => {
+    if (sessionExpiredRef.current) return; // run once per session
+    sessionExpiredRef.current = true;
+    storage.remove("token");
+    storage.remove("user");
+    setUser(null);
+    setApi(null);
+    queryClient.clear();
+    storage.remove("REACT_QUERY_OFFLINE_CACHE");
+    // Saved credentials are kept so the user can quick-login again.
+  }, [setUser, setApi, queryClient]);
+
+  useEffect(() => {
+    // Only guard an authenticated session. A pre-auth api (login screen) keeps
+    // its own handling — a wrong-password 401 is not a session expiry.
+    if (!api?.accessToken) return;
+    sessionExpiredRef.current = false; // re-arm for this fresh session
+    const interceptorId = api.axiosInstance.interceptors.response.use(
+      (response) => response,
+      (error) => {
+        if (error?.response?.status === 401) {
+          handleSessionExpired();
+        }
+        return Promise.reject(error);
+      },
+    );
+    return () => {
+      api.axiosInstance.interceptors.response.eject(interceptorId);
+    };
+  }, [api, handleSessionExpired]);
+
   const headers = useMemo(() => {
     if (!deviceId) return {};
     return {
@@ -307,6 +359,37 @@ export const JellyfinProvider: React.FC<{ children: ReactNode }> = ({
     },
   });
 
+  // Persist the CURRENT session to secure storage — used by the post-login
+  // save-account modal (the protection picker shows AFTER a successful
+  // login, for both the password and Quick Connect flows).
+  const saveCurrentAccount = useCallback(
+    async (options?: {
+      securityType?: AccountSecurityType;
+      pinCode?: string;
+      serverName?: string;
+    }) => {
+      const token = storage.getString("token");
+      if (!api?.basePath || !user?.Id || !user.Name || !token) return;
+      const securityType = options?.securityType || "none";
+      let pinHash: string | undefined;
+      if (securityType === "pin" && options?.pinCode) {
+        pinHash = await hashPIN(options.pinCode);
+      }
+      await saveAccountCredential({
+        serverUrl: api.basePath,
+        serverName: options?.serverName || "",
+        token,
+        userId: user.Id,
+        username: user.Name,
+        savedAt: Date.now(),
+        securityType,
+        pinHash,
+        primaryImageTag: user.PrimaryImageTag ?? undefined,
+      });
+    },
+    [api?.basePath, user],
+  );
+
   const loginMutation = useMutation({
     mutationFn: async ({
       username,
@@ -509,7 +592,9 @@ export const JellyfinProvider: React.FC<{ children: ReactNode }> = ({
       }
     },
     onError: (error) => {
-      console.error("Quick login failed:", error);
+      // Expected, handled case (e.g. revoked token → "Session Expired", or
+      // server unreachable): the UI surfaces the message, so warn, don't error.
+      console.warn("Quick login failed:", error);
     },
   });
 
@@ -620,12 +705,14 @@ export const JellyfinProvider: React.FC<{ children: ReactNode }> = ({
             setUser(storedUser);
           }
 
-          // Dismiss splash screen with cached data immediately,
-          // fetch fresh user data in the background
-          setInitialLoaded(true);
-
-          try {
-            const response = await getUserApi(apiInstance).getCurrentUser();
+          // Validate the token and refresh user data in the background. Do NOT
+          // await this: the Jellyfin SDK axios instance has no timeout, so when
+          // offline this call hangs for the full OS TCP timeout (75-120s) and
+          // blocks splash dismissal. The cached storedUser (set above) is enough
+          // to render; on success we just refresh it.
+          getUserApi(apiInstance)
+            .getCurrentUser()
+            .then(async (response) => {
               setUser(response.data);
 
               // Migrate current session to secure storage if not already saved
@@ -659,15 +746,21 @@ export const JellyfinProvider: React.FC<{ children: ReactNode }> = ({
                   });
                 }
               }
-          } catch (e) {
-            // Background fetch failed — app already rendered with cached data
-            console.warn("Background user fetch failed, using cached data:", e);
-          }
-        } else {
-          setInitialLoaded(true);
+            })
+            .catch((e) => {
+              // Expected, handled case (offline, or a token the server rejects —
+              // the UI prompts re-login): warn, don't error. Log only
+              // status/message — never the raw error (axios errors carry the
+              // request config incl. the Authorization header / token).
+              console.warn(
+                "Background user validation failed:",
+                e?.response?.status ?? e?.message ?? "unknown error",
+              );
+            });
         }
       } catch (e) {
         console.error(e);
+      } finally {
         setInitialLoaded(true);
       }
     };
@@ -681,6 +774,7 @@ export const JellyfinProvider: React.FC<{ children: ReactNode }> = ({
     removeServer: () => removeServerMutation.mutateAsync(),
     login: (username, password, serverName, options) =>
       loginMutation.mutateAsync({ username, password, serverName, options }),
+    saveCurrentAccount,
     logout: () => logoutMutation.mutateAsync(),
     initiateQuickConnect,
     stopQuickConnectPolling,

utils/atoms/settings.ts

@@ -449,6 +449,11 @@ export const pluginSettingsAtom = atom<PluginLockableSettings | undefined>(
 const hasMeaningfulSettingValue = (value: unknown) =>
   value !== undefined && value !== null && value !== "";
 
+const getEffectiveSettingValue = <K extends keyof Settings>(
+  settings: Partial<Settings> | null | undefined,
+  settingsKey: K,
+) => settings?.[settingsKey] ?? defaultValues[settingsKey];
+
 export const useSettings = () => {
   const api = useAtomValue(apiAtom);
   const [_settings, setSettings] = useAtom(settingsAtom);
@@ -505,17 +510,7 @@ export const useSettings = () => {
     if (!_settings) {
       return;
     }
-    // Admin-locked settings are enforced at write time too: a control that
-    // isn't disabled in the UI must not persist a value the admin pinned.
-    // The read memo already overrides locked keys, but without this guard the
-    // write would silently land in user storage and resurface once unlocked.
-    const sanitizedUpdate = Object.fromEntries(
-      Object.entries(update).filter(
-        ([key]) => pluginSettings?.[key as keyof Settings]?.locked !== true,
-      ),
-    ) as Partial<Settings>;
-
-    const hasChanges = Object.entries(sanitizedUpdate).some(
+    const hasChanges = Object.entries(update).some(
       ([key, value]) => _settings[key as keyof Settings] !== value,
     );
 
@@ -524,7 +519,7 @@ export const useSettings = () => {
       const newSettings = {
         ...defaultValues,
         ..._settings,
-        ...sanitizedUpdate,
+        ...update,
       } as Settings;
       setSettings(newSettings);
       saveSettings(newSettings);
@@ -547,24 +542,13 @@ export const useSettings = () => {
         // Normalize object-typed settings from plugin (plain primitive → { key, value })
         value = normalizePluginValue(settingsKey, value);
 
-        // When unlocked, keep the user's value only if they explicitly diverged
-        // from the app default. Otherwise the plugin value is the admin's
-        // default and must win over the hardcoded app default — e.g. a toggle
-        // that was always locked then unlocked should reflect the plugin
-        // default, not the app's `false`. Object-typed settings compare by
-        // reference, so their behaviour is unchanged.
-        const userValue = _settings?.[settingsKey];
-        const userDiverged =
-          hasMeaningfulSettingValue(userValue) &&
-          userValue !== defaultValues[settingsKey];
+        const effectiveValue = getEffectiveSettingValue(_settings, settingsKey);
 
         (acc as any)[settingsKey] = locked
           ? value
-          : userDiverged
-            ? userValue
-            : hasMeaningfulSettingValue(value)
-              ? value
-              : defaultValues[settingsKey];
+          : hasMeaningfulSettingValue(effectiveValue)
+            ? effectiveValue
+            : value;
       }
       return acc;
     }, {});