CMM-2114: Fix media routing for Jetpack-connected sites that carry an Application Password

[adalpari]

Description

Media uploads and the Media Library were failing on Jetpack-connected self-hosted
sites that carry an Application Password.

The root cause is client-selection order in MediaStore. A Jetpack-connected site
logs in through WordPress.com (the Jetpack tunnel), but the app can also mint and
store Application Password credentials on it in the background (e.g. the Jetpack REST
connection flow, or credentials auto-generated for taxonomies / navigation menus).
Once those credentials are stored, SiteModel.isUsingSelfHostedRestApi() returns
true, because that predicate is simply:

isUsingSelfHostedRestApi() = !isWPCom() && apiRestUsernamePlain != null && apiRestPasswordPlain != null

Several media routing methods checked isUsingSelfHostedRestApi() before
isUsingWpComRestApi(), so these sites were routed to the self-hosted REST client and
talked to the self-hosted REST API directly instead of going through the WP.com REST
API. The bug does not actually depend on Application Passwords being "disabled" — any
Jetpack site carrying stored credentials is mis-routed. The failure just becomes
visible when that direct path stops working, e.g. when the stored credentials no
longer authenticate on the server (Application Passwords later disabled or revoked),
while the WP.com/Jetpack tunnel keeps working.

Note: this is not about a self-hosted site logged into the app directly. Those
sites are only supported via Application Passwords, so "a directly-logged-in
self-hosted site with Application Passwords disabled" cannot exist. The affected
sites are self-hosted WordPress installs connected through Jetpack.

This PR:

• Adds a single getMediaRestClientType(SiteModel) helper (with a MediaRestClientType
  enum) that centralizes network-client resolution and guarantees the WP.com REST API
  check runs before the self-hosted REST API check.
• Refactors all six media routing methods (push, upload, fetchList, fetch,
  delete, cancel) to use this shared helper, removing the previously duplicated —
  and inconsistently ordered — selection logic.
• Adds unit tests covering the ambiguous Jetpack + Application Password case as well as
  the self-hosted, WP.com, and XML-RPC paths.

Testing instructions

1. Log into a Jetpack-connected self-hosted site with no AP
2. Open the Media Library

• Verify existing media loads instead of failing

3. Upload a new photo or video

• Verify the upload completes successfully

4. Repeat on a WP.com site and on a directly-connected self-hosted (Application Password) site

• Verify media upload and the Media Library still work as before

🤖 Generated with Claude Code

[dangermattic]

	1 Warning
⚠️	PR is not assigned to a milestone.

Generated by 🚫 Danger

[wpmobilebot]

📲 You can test the changes from this Pull Request in WordPress Android by scanning the QR code below to install the corresponding build.

	App Name	WordPress Android
	Build Type	Debug
	Version	pr23117-22ec114
	Build Number	1498
	Application ID	org.wordpress.android.prealpha
	Commit	22ec114
	Installation URL	20cehqktpug8g

Automatticians: You can use our internal self-serve MC tool to give yourself access to those builds if needed.

[wpmobilebot]

📲 You can test the changes from this Pull Request in Jetpack Android by scanning the QR code below to install the corresponding build.

	App Name	Jetpack Android
	Build Type	Debug
	Version	pr23117-22ec114
	Build Number	1498
	Application ID	com.jetpack.android.prealpha
	Commit	22ec114
	Installation URL	10b2kg7sacnvg

Automatticians: You can use our internal self-serve MC tool to give yourself access to those builds if needed.

[codecov]

Codecov Report

❌ Patch coverage is 23.40426% with 36 lines in your changes missing coverage. Please review.
✅ Project coverage is 37.69%. Comparing base (2732588) to head (22ec114).
⚠️ Report is 1 commits behind head on trunk.

Files with missing lines	Patch %	Lines
.../org/wordpress/android/fluxc/store/MediaStore.java	23.40%	34 Missing and 2 partials ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##            trunk   #23117   +/-   ##
=======================================
  Coverage   37.68%   37.69%           
=======================================
  Files        2343     2343           
  Lines      127339   127339           
  Branches    17669    17658   -11     
=======================================
+ Hits        47984    47995   +11     
+ Misses      75424    75411   -13     
- Partials     3931     3933    +2     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[nbradbury]

@adalpari I used a plugin to deactivate application passwords, but I'm unable to login to it in the app.

[adalpari]

@adalpari I used a plugin to deactivate application passwords, but I'm unable to login to it in the app.

Oh, that's my bad. You can't connect to a self-hosted site without AP that way. It has to be a site linked to your wpcom account. I haven't tested that scenario, but Claude for some reason, went ahead that way. Actually, that scenario is a supposition since we want all the self-hosted sites to use AP.

[nbradbury]