fix: remediate audited defects (resolves #29, #30, #31, #32)

- Fix permanent qBittorrent fallback degradation by resetting fallback flags during group-by polling (resolves #29)
- Fix Ombi webhook key mismatch in status endpoint and test mocks (resolves #30)
- Prevent timingSafeEqual TypeErrors on multi-byte CSRF token length mismatches (resolves #31)
- Eliminate duplicate write stream on server.log by delegating to index.js console override (resolves #32)

tests/unit/downloadClients.test.js

@@ -219,11 +219,13 @@ describe('DownloadClientRegistry', () => {
     });
 
     it('should get downloads grouped by client type', async () => {
+      const qbClient = testRegistry.getClient('qb1');
       const downloadsByType = await testRegistry.getDownloadsByClientType();
       
       expect(downloadsByType.sabnzbd).toHaveLength(1);
       expect(downloadsByType.qbittorrent).toHaveLength(1);
       expect(downloadsByType.transmission).toBeUndefined();
+      expect(qbClient.resetFallbackFlag).toHaveBeenCalled();
     });
 
     it('should handle client errors gracefully', async () => {