fix: address code review findings

- Preserve MBID and last_synced across periodic artist syncs (INSERT OR
  REPLACE was wiping them, forcing MusicBrainz re-resolution every cycle)
- Exclude unmonitored artists from unnotified-release digest query
- Require telegram.cron_schedule when telegram.enabled is true
- Add same-origin CSRF defense to state-changing web POST routes
- Skip WAL/busy_timeout pragmas for :memory: databases (no-op there)
- Scan mbid as sql.NullString in GetAllArtistSettings to tolerate NULLs

internal/navidrome/sync.go

@@ -107,9 +107,11 @@ func SyncArtists(ctx context.Context, client *NavidromeClient, db *database.DB)
 		}
 		existing, err := database.GetArtistSettings(db, artist.ID)
 		if err == nil {
+			settings.MBID = existing.MBID
 			settings.Monitored = existing.Monitored
 			settings.IgnoreSingles = existing.IgnoreSingles
 			settings.IgnoreCompilations = existing.IgnoreCompilations
+			settings.LastSynced = existing.LastSynced
 		} else if !errors.Is(err, database.ErrArtistNotFound) {
 			return fmt.Errorf("sync artists: get settings for artist %s: %w", artist.ID, err)
 		}