fix: address code review findings

- Preserve MBID and last_synced across periodic artist syncs (INSERT OR
  REPLACE was wiping them, forcing MusicBrainz re-resolution every cycle)
- Exclude unmonitored artists from unnotified-release digest query
- Require telegram.cron_schedule when telegram.enabled is true
- Add same-origin CSRF defense to state-changing web POST routes
- Skip WAL/busy_timeout pragmas for :memory: databases (no-op there)
- Scan mbid as sql.NullString in GetAllArtistSettings to tolerate NULLs

internal/config/config.go

@@ -141,6 +141,9 @@ func validate(cfg *Config) error {
 		if cfg.Telegram.ChatID == "" {
 			return fmt.Errorf("telegram.chat_id is required when telegram.enabled is true")
 		}
+		if cfg.Telegram.CronSchedule == "" {
+			return fmt.Errorf("telegram.cron_schedule is required when telegram.enabled is true")
+		}
 	}
 	return nil
 }