fix: remediate audited defects (resolves #29, #30, #31, #32)

- Fix permanent qBittorrent fallback degradation by resetting fallback flags during group-by polling (resolves #29)
- Fix Ombi webhook key mismatch in status endpoint and test mocks (resolves #30)
- Prevent timingSafeEqual TypeErrors on multi-byte CSRF token length mismatches (resolves #31)
- Eliminate duplicate write stream on server.log by delegating to index.js console override (resolves #32)

tests/unit/verifyCsrf.test.js

@@ -81,5 +81,14 @@ describe('verifyCsrf middleware', () => {
       expect(res.statusCode).toBe(403);
       expect(res.body.error).toBe('CSRF token invalid');
     });
+
+    it('blocks when tokens have same character length but different byte lengths (multi-byte)', () => {
+      const next = vi.fn();
+      const res = makeRes();
+      verifyCsrf(makeReq('POST', 'cafe\u0301', 'cafes'), res, next);
+      expect(res.statusCode).toBe(403);
+      expect(res.body.error).toBe('CSRF token invalid');
+      expect(next).not.toHaveBeenCalled();
+    });
   });
 });