fix: address code review findings

- Preserve MBID and last_synced across periodic artist syncs (INSERT OR
  REPLACE was wiping them, forcing MusicBrainz re-resolution every cycle)
- Exclude unmonitored artists from unnotified-release digest query
- Require telegram.cron_schedule when telegram.enabled is true
- Add same-origin CSRF defense to state-changing web POST routes
- Skip WAL/busy_timeout pragmas for :memory: databases (no-op there)
- Scan mbid as sql.NullString in GetAllArtistSettings to tolerate NULLs

internal/database/notifications.go

@@ -28,13 +28,16 @@ func IsNotificationSent(db *DB, rgid string) (bool, error) {
 	return count > 0, nil
 }
 
-// GetUnnotifiedReleases returns all external_release rows that have no entry in notifications_sent.
+// GetUnnotifiedReleases returns all external_release rows for monitored artists
+// that have no entry in notifications_sent. Releases belonging to unmonitored
+// artists are excluded so the digest honors the monitoring contract.
 func GetUnnotifiedReleases(db *DB) ([]ExternalRelease, error) {
 	rows, err := db.Conn().Query(`
 		SELECT e.rgid, e.artist_id, e.title, e.type, e.release_date, e.is_ignored
 		FROM external_releases e
+		JOIN artist_settings s ON e.artist_id = s.id
 		LEFT JOIN notifications_sent n ON e.rgid = n.rgid
-		WHERE n.rgid IS NULL AND e.is_ignored = 0
+		WHERE s.monitored = 1 AND n.rgid IS NULL AND e.is_ignored = 0
 	`)
 	if err != nil {
 		return nil, fmt.Errorf("query unnotified releases: %w", err)