fix: secure webhook config endpoint and validate config on Ombi enable/test

- Add requireAuth to GET /api/webhook/config to enforce authentication
- Add SOFARR_BASE_URL and SOFARR_WEBHOOK_SECRET validation to POST /api/ombi/webhook/enable and /test
- Return 400 with descriptive errors when webhook config is missing on Ombi routes
- Clean up test environment in webhook.test.js afterEach
- Add regression tests for all new validation logic
- Update CHANGELOG.md with security fixes

client/src/api.js

@@ -137,7 +137,19 @@ export async function fetchWebhookStatus() {
   try {
     // Fetch metrics in parallel
     const metricsPromise = fetchWebhookMetrics();
-    
+
+    // Fetch webhook configuration status (checks SOFARR_BASE_URL and SOFARR_WEBHOOK_SECRET)
+    let webhookConfigValid = false;
+    try {
+      const configRes = await fetch('/api/webhook/config');
+      if (configRes.ok) {
+        const configData = await configRes.json();
+        webhookConfigValid = configData.valid || false;
+      }
+    } catch (err) {
+      // Config endpoint not available, assume invalid
+    }
+
     // Fetch Sonarr notifications
     let sonarrEnabled = false;
     let sonarrTriggers = { onGrab: false, onDownload: false, onImport: false, onUpgrade: false };
@@ -146,7 +158,7 @@ export async function fetchWebhookStatus() {
       if (sonarrRes.ok) {
         const sonarrData = await sonarrRes.json();
         const sonarrSofarr = sonarrData.find(n => n.name === 'Sofarr');
-        sonarrEnabled = !!sonarrSofarr;
+        sonarrEnabled = webhookConfigValid && !!sonarrSofarr;
         if (sonarrSofarr) {
           sonarrTriggers = {
             onGrab: sonarrSofarr.onGrab,
@@ -159,7 +171,7 @@ export async function fetchWebhookStatus() {
     } catch (err) {
       // Sonarr not configured
     }
-    
+
     // Fetch Radarr notifications
     let radarrEnabled = false;
     let radarrTriggers = { onGrab: false, onDownload: false, onImport: false, onUpgrade: false };
@@ -168,7 +180,7 @@ export async function fetchWebhookStatus() {
       if (radarrRes.ok) {
         const radarrData = await radarrRes.json();
         const radarrSofarr = radarrData.find(n => n.name === 'Sofarr');
-        radarrEnabled = !!radarrSofarr;
+        radarrEnabled = webhookConfigValid && !!radarrSofarr;
         if (radarrSofarr) {
           radarrTriggers = {
             onGrab: radarrSofarr.onGrab,