fix: address code review findings

- notifier: show artist display names (not internal IDs) in digest; resolve
  names from artist_settings and fall back to ID when unavailable
- notifier: skip sending an empty digest to avoid daily spam
- config: require telegram token/chat_id when enabled
- web: warn loudly when auth is disabled on a non-loopback bind; add HTTP
  server timeouts
- web: treat SetReleaseIgnored "release not found" as benign redirect (0 rows)
- musicbrainz: reject low-score/name-mismatched MBID resolutions instead of
  silently caching the wrong artist
- database: remove dead duplicate err check; harden DSN param appending
- musicbrainz: check rows.Err() after iterating existing releases

internal/config/config.go

@@ -134,5 +134,13 @@ func validate(cfg *Config) error {
 	if cfg.Sync.Interval <= 0 {
 		return fmt.Errorf("sync.interval must be positive, got %v", cfg.Sync.Interval)
 	}
+	if cfg.Telegram.Enabled {
+		if cfg.Telegram.Token == "" {
+			return fmt.Errorf("telegram.token is required when telegram.enabled is true")
+		}
+		if cfg.Telegram.ChatID == "" {
+			return fmt.Errorf("telegram.chat_id is required when telegram.enabled is true")
+		}
+	}
 	return nil
 }