fix: address code review findings

- Preserve MBID and last_synced across periodic artist syncs (INSERT OR
  REPLACE was wiping them, forcing MusicBrainz re-resolution every cycle)
- Exclude unmonitored artists from unnotified-release digest query
- Require telegram.cron_schedule when telegram.enabled is true
- Add same-origin CSRF defense to state-changing web POST routes
- Skip WAL/busy_timeout pragmas for :memory: databases (no-op there)
- Scan mbid as sql.NullString in GetAllArtistSettings to tolerate NULLs

internal/web/handlers.go

@@ -214,6 +214,10 @@ func (s *Server) ignoreOrRestore(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
 		return
 	}
+	if !s.sameOrigin(r) {
+		http.Error(w, "forbidden: cross-origin request", http.StatusForbidden)
+		return
+	}
 	id := r.PathValue("id")
 	if id == "" {
 		http.NotFound(w, r)
@@ -261,6 +265,10 @@ func (s *Server) toggleIgnoreSingles(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
 		return
 	}
+	if !s.sameOrigin(r) {
+		http.Error(w, "forbidden: cross-origin request", http.StatusForbidden)
+		return
+	}
 	id := r.PathValue("id")
 	if id == "" {
 		http.NotFound(w, r)