fix: address code review findings

- Honor ignore_singles/ignore_compilations at scanner read time so toggles
  take effect immediately on the dashboard, artist page, and digest instead
  of waiting for the MusicBrainz cache to expire and prune rows.
- Run notifier notify synchronously in the scheduler loop to avoid overlapping
  read-send-mark runs double-sending the digest.
- Show artist name (with ID fallback) on the archive page instead of raw IDs.
- Select last_synced in GetAllArtistSettings for contract consistency.
- Fix stale startPeriodicSync comment and remove redundant error var.
- Remove dead ignored-branch from the artist template (never rendered).
- Add tests: CSRF sameOrigin, ArtistCacheFresh, secondary_types round-trip,
  and scanner type-toggle filtering.
- Update Specification.md schema/config to reflect mbid, last_synced,
  secondary_types, sync.interval, and server.public_url.

internal/notifier/scheduler.go

@@ -114,9 +114,11 @@ type notifyFunc func(ctx context.Context) error
 
 // StartScheduler runs the notify function on a schedule until ctx is cancelled.
 // It is no-op-safe: if enabled is false it returns immediately without starting
-// a goroutine. Each firing runs in its own goroutine so a slow send does not
-// delay the next scheduled tick; the scheduler still computes the next tick from
-// the wall clock and does not drift.
+// a goroutine. Each firing runs synchronously (in the scheduler's own
+// goroutine): NotifyOnce reads the unnotified set and marks releases sent
+// non-atomically, so overlapping runs would double-send the digest. Running one
+// fire at a time keeps the read-send-mark sequence safe; the next tick is still
+// computed from the wall clock and does not drift.
 //
 // The schedule and notify function are injectable so tests can drive a fixed or
 // frequent schedule without a real cron spec or Telegram server.
@@ -157,14 +159,12 @@ func StartScheduler(ctx context.Context, enabled bool, schedule Schedule, notify
 				log.Println("Notifier scheduler stopped.")
 				return
 			case <-timer.C:
-				go func() {
-					if err := notify(ctx); err != nil {
-						if ctx.Err() != nil {
-							return
-						}
-						log.Printf("Notifier run failed: %v", err)
+				if err := notify(ctx); err != nil {
+					if ctx.Err() != nil {
+						return
 					}
-				}()
+					log.Printf("Notifier run failed: %v", err)
+				}
 			}
 		}
 	}()