feat(webhook): implement Phase 1 webhook receiver for Sonarr and Radarr

- Added POST /api/webhook/sonarr and POST /api/webhook/radarr endpoints
- Implemented webhook secret validation via SOFARR_WEBHOOK_SECRET environment variable
- Added logging for all incoming webhook events using existing logToFile utility
- Returns HTTP 200 immediately to prevent webhook retries
- Mounted webhook routes before CSRF middleware (called by external services)
- Non-breaking: no changes to polling, caching, SSE, or any existing behavior
- Lays groundwork for Phase 2 (cache + SSE integration) without implementing it yet

server/utils/config.js

@@ -114,6 +114,10 @@ function getRtorrentInstances() {
   );
 }
 
+function getWebhookSecret() {
+  return process.env.SOFARR_WEBHOOK_SECRET || '';
+}
+
 module.exports = {
   getSABnzbdInstances,
   getSonarrInstances,
@@ -121,6 +125,7 @@ module.exports = {
   getQbittorrentInstances,
   getTransmissionInstances,
   getRtorrentInstances,
+  getWebhookSecret,
   parseInstances,
   validateInstanceUrl
 };