docs: align swagger spec and README with Ombi features and blocklist eligibility (closes #37)

ARCHITECTURE.md

@@ -62,7 +62,7 @@ flowchart TB
         auth_r["Auth Routes\n/api/auth"]
         dash_r["Dashboard Routes\n/api/dashboard  (SSE /stream)"]
         stat_r["Status Routes\n/api/status"]
-        wh_r["Webhook Routes\n/api/webhook/sonarr|radarr"]
+        wh_r["Webhook Routes\n/api/webhook/sonarr|radarr|ombi"]
         ombi_r["Ombi Routes\n/api/ombi"]
         hist_r["History Routes\n/api/history"]
         proxy_r["Proxy Routes\n/api/sonarr · /api/radarr\n/api/sabnzbd · /api/emby"]
@@ -119,7 +119,7 @@ flowchart TB
 Browser (SPA)
     │  POST /api/auth/login          → Auth routes → Emby verify → set httpOnly cookie
     │  GET  /api/dashboard/stream    → SSE stream → cache → matched downloads
-    │  POST /api/webhook/*           ← Sonarr/Radarr push events
+    │  POST /api/webhook/*           ← Sonarr/Radarr/Ombi push events
     │
     ▼
 Express Server (:3001)
@@ -132,10 +132,12 @@ Express Server (:3001)
     ├── /api/auth          → login, logout, me, csrf
     ├── /api/webhook       → [rate-limit] → [secret validation] → [payload validation]
     │                        → [replay check] → updateWebhookMetrics → processWebhookEvent
+    │                        → /config: GET endpoint for configuration status validation
     ├── /api/dashboard     → requireAuth → read cache → DownloadBuilder → SSE/JSON
     ├── /api/status          → requireAuth → admin cache/polling/webhook status
     ├── /api/history         → requireAuth → historyFetcher (5 min cache) → filter + dedup
     ├── /api/ombi            → requireAuth → PALDRA → filter/sort/search → JSON
+    │                        → /webhook/*: enable (POST), status (GET), and test (POST) endpoints
     ├── /api/sonarr|radarr   → requireAuth → verifyCsrf → proxy to *arr API
     └── /api/sabnzbd|emby    → requireAuth → verifyCsrf → proxy
 
@@ -380,11 +382,12 @@ Unmatched torrents are **not** included in the response (fixed in develop-refact
 
 ### 4.1 Webhook Receiver
 
-sofarr exposes two webhook endpoints that Sonarr and Radarr can be configured to call on every automation event:
+sofarr exposes three webhook endpoints that Sonarr, Radarr, and Ombi can be configured to call on automation and request events:
 
 ```
 POST /api/webhook/sonarr
 POST /api/webhook/radarr
+POST /api/webhook/ombi
 ```
 
 Both endpoints share identical processing logic:
@@ -468,6 +471,8 @@ The dashboard therefore receives fresh data within the round-trip time of the *a
 
 The `sonarr.js` and `radarr.js` route modules expose endpoints (under `/api/sonarr` and `/api/radarr` respectively, behind `requireAuth` + `verifyCsrf`) for one-click webhook configuration. These proxy to the *arr notification API to create, update, or remove the sofarr webhook connection in Sonarr/Radarr, using `SOFARR_BASE_URL` to construct the target URL.
 
+Similarly, the `ombi.js` route module exposes endpoints under `/api/ombi/webhook/` (including `/enable`, `/status`, and `/test`) to support one-click registration and validation of the Sofarr webhook inside the configured Ombi instance.
+
 ---
 
 ## 5. Data Flow and Real-time Updates