feat(external): per-host enable toggles in Settings (Phase 4d)

Operator lever: disable a single file host (e.g. mega.nz when it's banning)
without touching the others. Five booleans on import_settings
(extdl_<host>_enabled, default true — works out of the box, rule #26); the
worker already reads them via getattr so no worker change. Migration 0050 +
model fields + settings GET/PATCH (uniform boolean validation) + a
'External file-host downloads' card in the subscriptions Settings tab.

Completes Phase 4. Refs FC #830.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/test_api_settings_downloader.py

@@ -44,3 +44,24 @@ async def test_patch_rejects_non_bool_validate(client):
         "/api/settings/import", json={"download_validate_files": "yes"}
     )
     assert resp.status_code == 400
+
+
+@pytest.mark.asyncio
+async def test_extdl_host_toggles_default_on_and_patch(client):
+    body = await (await client.get("/api/settings/import")).get_json()
+    assert body["extdl_mega_enabled"] is True
+    assert body["extdl_pixeldrain_enabled"] is True
+
+    resp = await client.patch(
+        "/api/settings/import", json={"extdl_mega_enabled": False}
+    )
+    assert resp.status_code == 200
+    assert (await resp.get_json())["extdl_mega_enabled"] is False
+
+
+@pytest.mark.asyncio
+async def test_extdl_toggle_rejects_non_bool(client):
+    resp = await client.patch(
+        "/api/settings/import", json={"extdl_gdrive_enabled": "nope"}
+    )
+    assert resp.status_code == 400