fix(admin): approve flow surfaces real errors; auto-default Lidarr picks

The "I can't approve a request, the toast just says unknown" bug was
four problems compounded:

1. Lidarr config let enabled=true save with default_quality_profile_id=0
   and default_root_folder_path=''. Approve then sent invalid POST bodies
   to Lidarr, which 5xx'd.
2. lidarr.client.post() discarded Lidarr's response body on error, so
   we couldn't tell why Lidarr 5xx'd from server logs.
3. handleApproveRequest's error switch didn't map ErrServerError or
   ErrLookupFailed — both fell through to a generic 500 server_error.
4. apiFetch only parsed {error: {code, message}} envelopes, but admin
   endpoints write {error: 'code_string'}. Every admin error toast
   rendered as 'unknown'.

Fixes:

- internal/lidarr/client.go: capture up to 512 bytes of Lidarr's response
  body when it returns 4xx/5xx; include in the wrapped error so server
  logs show what Lidarr actually said instead of just the status bucket.
- internal/lidarrrequests/service.go: new ErrDefaultsIncomplete fires
  before the Lidarr call when QP=0 or root_folder=''. Stops the bad
  POST entirely.
- internal/api/admin_requests.go: handleApproveRequest now maps
  ErrDefaultsIncomplete -> 'lidarr_defaults_incomplete' (400),
  ErrServerError -> 'lidarr_server_error' (502),
  ErrLookupFailed -> 'lidarr_rejected' (502).
- internal/api/admin_lidarr.go: handlePutLidarrConfig now requires
  QP + root folder to be set whenever enabled=true.
- web/src/lib/api/client.ts: apiFetch handles both error envelope shapes
  so admin error codes propagate to toasts.
- web/src/routes/admin/integrations/+page.svelte: auto-default to the
  first quality profile and first root folder Lidarr returns when the
  operator hasn't picked one yet — saves a click for typical
  one-profile/one-folder home setups.
- web/src/routes/admin/requests/+page.svelte: friendly toast copy for
  the new error codes.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/lidarr/client.go

@@ -57,16 +57,28 @@ func (c *Client) get(ctx context.Context, path string, q url.Values) (*http.Resp
 		return nil, ErrAuthFailed
 	}
 	if resp.StatusCode >= 500 {
+		body := readBodySnippet(resp.Body)
 		_ = resp.Body.Close()
-		return nil, ErrServerError
+		return nil, fmt.Errorf("%w: %d: %s", ErrServerError, resp.StatusCode, body)
 	}
 	if resp.StatusCode >= 400 {
+		body := readBodySnippet(resp.Body)
 		_ = resp.Body.Close()
-		return nil, ErrLookupFailed
+		return nil, fmt.Errorf("%w: %d: %s", ErrLookupFailed, resp.StatusCode, body)
 	}
 	return resp, nil
 }
 
+// readBodySnippet reads up to 512 bytes from an error response body so the
+// wrapped error message can include Lidarr's actual complaint (e.g.
+// `{"errorMessage":"Artist already exists in your library"}`). Without this,
+// callers see only the status-code bucket and can't diagnose without
+// cross-referencing Lidarr's own logs.
+func readBodySnippet(r io.Reader) string {
+	buf, _ := io.ReadAll(io.LimitReader(r, 512))
+	return strings.TrimSpace(string(buf))
+}
+
 // post is the shared POST helper. body must be marshaled JSON. It maps HTTP
 // status codes to typed errors; the caller is responsible for closing the
 // returned body.
@@ -91,12 +103,14 @@ func (c *Client) post(ctx context.Context, path string, body []byte) (*http.Resp
 		return nil, ErrAuthFailed
 	}
 	if resp.StatusCode >= 500 {
+		body := readBodySnippet(resp.Body)
 		_ = resp.Body.Close()
-		return nil, ErrServerError
+		return nil, fmt.Errorf("%w: %d: %s", ErrServerError, resp.StatusCode, body)
 	}
 	if resp.StatusCode >= 400 {
+		body := readBodySnippet(resp.Body)
 		_ = resp.Body.Close()
-		return nil, ErrLookupFailed
+		return nil, fmt.Errorf("%w: %d: %s", ErrLookupFailed, resp.StatusCode, body)
 	}
 	return resp, nil
 }