Move integration credentials out of query strings

[stevenepalmer]

Summary

• Send TMDB/TVDB API keys and media-service credentials in authenticated JSON request bodies instead of URL query strings.
• Change Radarr/Sonarr profile discovery to authenticated POST requests with JSON bodies.
• Update the shared frontend API, Settings UI, and Admin UI callers.
• Mark successful credential-check responses Cache-Control: no-store and use Pydantic SecretStr fields to keep secrets out of model representations.

Why

Query parameters are commonly retained in reverse-proxy and application access logs. These endpoints are authenticated, but their request targets currently include provider tokens and API keys. Moving the values into request bodies preserves provider behavior while keeping credentials out of normal URL logging paths.

Compatibility

• Provider requests and validation behavior are unchanged.
• The first-party frontend callers are updated in the same commit.
• Webhook api_key query parameters are intentionally unchanged because Plex/Jellyfin webhook configuration depends on URL-based credentials.

Tests

• PYTHONPATH=/tmp/scrob-pr-python-deps python3 -m unittest discover -s tests — 90 passed
• npm ci && npm run build — production build passed
• git diff --check — passed