Prefer curl impersonation for protected media

test_app.py

@@ -4297,6 +4297,9 @@ class TemplateHelperTests(unittest.TestCase):
         self.assertEqual(lock["packages"]["node_modules/cheerio"]["version"], "1.0.0")
         self.assertIn("COPY package.json package-lock.json /app/", dockerfile)
         self.assertIn("npm ci --omit=dev", dockerfile)
+        self.assertIn("FROM lexiforest/curl-impersonate:v2.2.2 AS curl_impersonate", dockerfile)
+        self.assertIn("COPY --from=curl_impersonate /usr/local/bin/ /usr/local/bin/", dockerfile)
+        self.assertIn("LD_LIBRARY_PATH=/usr/local/lib", dockerfile)
 
     def test_docker_compose_exposes_jellyfin_browse_roots(self):
         compose = (ROOT / "docker-compose.yaml").read_text(encoding="utf-8")
@@ -4541,6 +4544,27 @@ seg-3.ts
         self.assertIn("--header", run.call_args.args[0])
         self.assertIn("Referer: https://player.example/", run.call_args.args[0])
 
+    def test_curl_request_headers_preserve_browser_wrapper_defaults(self):
+        headers = provider_downloader.curl_request_headers(
+            "/usr/local/bin/curl_chrome142",
+            {"Referer": "https://player.example/"},
+        )
+
+        self.assertEqual(headers, {"Referer": "https://player.example/"})
+
+    def test_curl_candidates_prefer_new_browser_wrappers(self):
+        def fake_which(name):
+            if name in {"curl_chrome142", "curl_chrome120", "curl"}:
+                return f"/usr/local/bin/{name}"
+            return None
+
+        with mock.patch.object(provider_downloader.shutil, "which", side_effect=fake_which), mock.patch.object(
+            provider_downloader.os, "access", return_value=False
+        ):
+            candidates = provider_downloader.curl_candidates()
+
+        self.assertEqual(candidates[:3], ["/usr/local/bin/curl_chrome142", "/usr/local/bin/curl_chrome120", "/usr/local/bin/curl"])
+
     def test_fetch_bytes_retries_forbidden_media_with_curl_fallback(self):
         error = urllib.error.HTTPError(
             "https://cdn.example/segment.ts",