fix(admin): approve flow surfaces real errors; auto-default Lidarr picks

The "I can't approve a request, the toast just says unknown" bug was
four problems compounded:

1. Lidarr config let enabled=true save with default_quality_profile_id=0
   and default_root_folder_path=''. Approve then sent invalid POST bodies
   to Lidarr, which 5xx'd.
2. lidarr.client.post() discarded Lidarr's response body on error, so
   we couldn't tell why Lidarr 5xx'd from server logs.
3. handleApproveRequest's error switch didn't map ErrServerError or
   ErrLookupFailed — both fell through to a generic 500 server_error.
4. apiFetch only parsed {error: {code, message}} envelopes, but admin
   endpoints write {error: 'code_string'}. Every admin error toast
   rendered as 'unknown'.

Fixes:

- internal/lidarr/client.go: capture up to 512 bytes of Lidarr's response
  body when it returns 4xx/5xx; include in the wrapped error so server
  logs show what Lidarr actually said instead of just the status bucket.
- internal/lidarrrequests/service.go: new ErrDefaultsIncomplete fires
  before the Lidarr call when QP=0 or root_folder=''. Stops the bad
  POST entirely.
- internal/api/admin_requests.go: handleApproveRequest now maps
  ErrDefaultsIncomplete -> 'lidarr_defaults_incomplete' (400),
  ErrServerError -> 'lidarr_server_error' (502),
  ErrLookupFailed -> 'lidarr_rejected' (502).
- internal/api/admin_lidarr.go: handlePutLidarrConfig now requires
  QP + root folder to be set whenever enabled=true.
- web/src/lib/api/client.ts: apiFetch handles both error envelope shapes
  so admin error codes propagate to toasts.
- web/src/routes/admin/integrations/+page.svelte: auto-default to the
  first quality profile and first root folder Lidarr returns when the
  operator hasn't picked one yet — saves a click for typical
  one-profile/one-folder home setups.
- web/src/routes/admin/requests/+page.svelte: friendly toast copy for
  the new error codes.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/api/admin_lidarr.go

@@ -94,6 +94,14 @@ func (h *handlers) handlePutLidarrConfig(w http.ResponseWriter, r *http.Request)
 			writeAdminJSONErr(w, http.StatusBadRequest, "invalid_url")
 			return
 		}
+		// Defaults must be present so future Approve calls don't dispatch
+		// invalid POST bodies to Lidarr (which produces 5xx with no useful
+		// detail). The frontend pre-selects first values so this almost
+		// never fires for non-malicious traffic, but it's the right gate.
+		if body.DefaultQualityProfileID == 0 || body.DefaultRootFolderPath == "" {
+			writeAdminJSONErr(w, http.StatusBadRequest, "missing_defaults")
+			return
+		}
 	}
 
 	cfg := lidarrconfig.Config{

internal/api/admin_requests.go

@@ -94,6 +94,8 @@ func (h *handlers) handleApproveRequest(w http.ResponseWriter, r *http.Request)
 		switch {
 		case errors.Is(err, lidarrrequests.ErrLidarrDisabled):
 			writeAdminJSONErr(w, http.StatusServiceUnavailable, "lidarr_disabled")
+		case errors.Is(err, lidarrrequests.ErrDefaultsIncomplete):
+			writeAdminJSONErr(w, http.StatusBadRequest, "lidarr_defaults_incomplete")
 		case errors.Is(err, lidarrrequests.ErrNotFound):
 			writeAdminJSONErr(w, http.StatusNotFound, "request_not_found")
 		case errors.Is(err, lidarrrequests.ErrNotPending):
@@ -102,6 +104,16 @@ func (h *handlers) handleApproveRequest(w http.ResponseWriter, r *http.Request)
 			writeAdminJSONErr(w, http.StatusServiceUnavailable, "lidarr_unreachable")
 		case errors.Is(err, lidarr.ErrAuthFailed):
 			writeAdminJSONErr(w, http.StatusServiceUnavailable, "lidarr_auth_failed")
+		case errors.Is(err, lidarr.ErrServerError):
+			// Lidarr itself 5xx'd — its response body is in err's wrapped
+			// message (see lidarr.readBodySnippet). Logged below for ops.
+			h.logger.Error("admin: approve request: lidarr 5xx", "err", err)
+			writeAdminJSONErr(w, http.StatusBadGateway, "lidarr_server_error")
+		case errors.Is(err, lidarr.ErrLookupFailed):
+			// Lidarr returned 4xx — usually "artist already exists" or
+			// "no metadata found." Log so ops can see the actual reason.
+			h.logger.Warn("admin: approve request: lidarr 4xx", "err", err)
+			writeAdminJSONErr(w, http.StatusBadGateway, "lidarr_rejected")
 		default:
 			h.logger.Error("admin: approve request", "err", err)
 			writeAdminJSONErr(w, http.StatusInternalServerError, "server_error")