fix: address code review findings

- Preserve MBID and last_synced across periodic artist syncs (INSERT OR
  REPLACE was wiping them, forcing MusicBrainz re-resolution every cycle)
- Exclude unmonitored artists from unnotified-release digest query
- Require telegram.cron_schedule when telegram.enabled is true
- Add same-origin CSRF defense to state-changing web POST routes
- Skip WAL/busy_timeout pragmas for :memory: databases (no-op there)
- Scan mbid as sql.NullString in GetAllArtistSettings to tolerate NULLs

internal/database/database.go

@@ -51,18 +51,20 @@ func New(dbPath string) (*DB, error) {
 	}
 	if dbPath == ":memory:" {
 		conn.SetMaxOpenConns(1)
-	}
+	} else {
+		// Enable WAL mode for better concurrent read performance. WAL is a
+		// no-op on in-memory databases (they always use the MEMORY journal), so
+		// skip it there to avoid misleading configuration.
+		if _, err := conn.Exec("PRAGMA journal_mode=WAL"); err != nil {
+			conn.Close()
+			return nil, fmt.Errorf("set WAL mode: %w", err)
+		}
 
-	// Enable WAL mode for better concurrent read performance.
-	if _, err := conn.Exec("PRAGMA journal_mode=WAL"); err != nil {
-		conn.Close()
-		return nil, fmt.Errorf("set WAL mode: %w", err)
-	}
-
-	// Set busy timeout to handle concurrent write contention.
-	if _, err := conn.Exec("PRAGMA busy_timeout=5000"); err != nil {
-		conn.Close()
-		return nil, fmt.Errorf("set busy timeout: %w", err)
+		// Set busy timeout to handle concurrent write contention.
+		if _, err := conn.Exec("PRAGMA busy_timeout=5000"); err != nil {
+			conn.Close()
+			return nil, fmt.Errorf("set busy timeout: %w", err)
+		}
 	}
 
 	db := &DB{conn: conn}