feat: arr-native distributed media sync + config architecture fixes

Arr sync (new):
- Media/arr_sync.sh — full mesh bidirectional sync across all HOST* nodes
  - Lidarr (MusicBrainz), Sonarr (TVDB), Radarr (TMDB) all handled in one script
  - Remote API keys read live from config.xml via SSH — never stored in conf files
  - Shared blocklist (DATA_DIR/arr_sync_blocklist.tsv) merged from all nodes at runtime
  - Graceful skip if arr not configured locally or not reachable on a remote node
  - --blocklist-add / --blocklist-remove / --blocklist-list management flags
- daily_sync_maintenance.sh — arr sync runs as explicit phase before rsync
- partnership_onboard.sh — Step 3 bootstraps merged library on both sides at onboard
- master.conf — ARR_SYNC_* config block, DOCKER_APPDATA_BASE

Rsync / cleanup:
- DEFAULT_RSYNC_OPTS — removed --delete; arr_cleanup.sh owns orphan enforcement
- lidarr_cleanup.sh — removed HOST1-only guard; runs on any node with Lidarr configured

Config architecture:
- HOST1/HOST2 hostnames moved from master_host*.conf → master.conf (not credentials)
- Sparse checkout now works correctly: each server only needs its own host conf
- detect_hosts() still resolves MY_ID + REMOTE_ID via master.conf hostname values

Bug fix:
- common.sh line 493 — watchdog toggle eval had broken quoting; all SYS_WATCHDOG_CHECK_*
  globals were silently set to empty instead of their configured values

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Fallback/fallback_test.sh

@@ -14,7 +14,7 @@
 #   Phase 1 — Pre-flight         verify both servers reachable, daemons healthy,
 #                                 version parity, fallback.sh exists, state is NORMAL
 #   Phase 2 — Block Remote       iptables rule drops all traffic to remote IP
-#   Phase 3 — Fallback Detection wait for fallback.sh to detect outage and enter FAILOVER
+#   Phase 3 — Fallback Detection wait for fallback.sh to detect outage and enter FALLBACK
 #   Phase 4 — Container Start    verify Tier 1 failover containers started locally
 #   Phase 5 — Restore            remove iptables rule, remote becomes reachable
 #   Phase 6 — Handback           wait for fallback.sh to complete handback to NORMAL