Add torrent acquisition integrations

[TheusHen]

Summary

This adds a complete acquisition layer for self-hosted reading setups. Users can configure indexers and download clients, search releases, submit magnets or torrent URLs, and keep an auditable job history.

The server now supports qBittorrent, Transmission, Deluge, Prowlarr, Torznab, and Newznab. It also supports Readarr, Sonarr, Radarr, Lidarr, and Whisparr through their native command APIs, so those applications remain responsible for their own library and release-grab decisions.

Enabled acquisition rules are processed periodically. Rules can either select the best indexer result for a BitTorrent client or trigger a configured Arr command.

Implementation notes

• Added persistent endpoint, rule, and job models with an Alembic migration.
• Added authenticated acquisition endpoints under /v1/acquisition.
• Kept endpoint credentials server-side and excluded them from response schemas.
• Added API and service tests for the private endpoint contract.

Validation

• uv run ruff check on the changed Python files
• uv run mypy on the changed Python files
• Verified the new routes are registered in the FastAPI application

The integration test suite was not run locally because PostgreSQL/Docker was unavailable.

[TheusHen]

Added the backend pieces requested by the client review:

• Exposed /v1/acquisition/capabilities so the client can confirm the active Papyrus server supports torrent acquisition.
• Removed Newznab/Usenet from the initial endpoint scope and kept indexers torrent-only through Prowlarr/Torznab.
• Added endpoint URL validation that rejects embedded credentials and non-HTTP(S) endpoint URLs.
• Store integration credentials encrypted at rest using the server secret key instead of raw JSON values.
• Kept Readarr/Sonarr/Radarr/Lidarr/Whisparr command support through explicit Arr command allowlists.
• Expanded acquisition route tests around capabilities, encrypted credentials, Newznab rejection, and URL validation.

Validation run locally:

• ruff check on changed acquisition/security files
• mypy on changed acquisition/security files
• capabilities runtime smoke check

Full pytest could not complete locally because Postgres on 127.0.0.1:5432 refused the connection, so database-backed route tests need CI or a running local Postgres.