feat: arr-native distributed media sync + config architecture fixes

Arr sync (new):
- Media/arr_sync.sh — full mesh bidirectional sync across all HOST* nodes
  - Lidarr (MusicBrainz), Sonarr (TVDB), Radarr (TMDB) all handled in one script
  - Remote API keys read live from config.xml via SSH — never stored in conf files
  - Shared blocklist (DATA_DIR/arr_sync_blocklist.tsv) merged from all nodes at runtime
  - Graceful skip if arr not configured locally or not reachable on a remote node
  - --blocklist-add / --blocklist-remove / --blocklist-list management flags
- daily_sync_maintenance.sh — arr sync runs as explicit phase before rsync
- partnership_onboard.sh — Step 3 bootstraps merged library on both sides at onboard
- master.conf — ARR_SYNC_* config block, DOCKER_APPDATA_BASE

Rsync / cleanup:
- DEFAULT_RSYNC_OPTS — removed --delete; arr_cleanup.sh owns orphan enforcement
- lidarr_cleanup.sh — removed HOST1-only guard; runs on any node with Lidarr configured

Config architecture:
- HOST1/HOST2 hostnames moved from master_host*.conf → master.conf (not credentials)
- Sparse checkout now works correctly: each server only needs its own host conf
- detect_hosts() still resolves MY_ID + REMOTE_ID via master.conf hostname values

Bug fix:
- common.sh line 493 — watchdog toggle eval had broken quoting; all SYS_WATCHDOG_CHECK_*
  globals were silently set to empty instead of their configured values

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

master_host2.conf

@@ -37,10 +37,10 @@
 #   DOCKER WATCHDOG         memory limits, health URLs, required containers, ignore list
 #   DOCKER NETWORK CONNECT  networks and containers for docker_network_connect.sh
 #
-#   ── FAILOVER ───────────────────────────────────────────────────────────────────────────────
+#   ── FALLBACK ───────────────────────────────────────────────────────────────────────────────
 #   DDNS                    DDNS containers managed by HOST2
 #   INTERNET LOSS           containers stopped when internet is lost
-#   FAILOVER TIERS          what HOST2 runs for HOST1 per tier
+#   FALLBACK TIERS          what HOST2 runs for HOST1 per tier
 #   TIER DELAYS             how long HOST2 must be down before each tier activates on HOST1
 #   RSYNC WRITEBACK         HOST2 appdata synced back on handback
 #
@@ -68,10 +68,7 @@
 # ==============================================================================================
 
 # ━━━ Identity ━━━
-# Hostname must match exact unRAID hostname AND Tailscale device name — case sensitive.
-# Used by detect_hosts() in common.sh to identify this server as HOST2.
-    HOST2="unRAID-Jayred365"
-
+# HOST2 hostname lives in master.conf (not a credential — safe for all servers).
 # SSH key used for all server-to-server operations — rsync, failover container commands.
 # Must be in /root/.ssh/ and authorised in HOST1's /root/.ssh/authorized_keys.
     HOST2_SSH_KEY="/root/.ssh/Jayred365-rsync-key"
@@ -241,7 +238,7 @@
     )
 
 # ==============================================================================================
-# ── FAILOVER ──────────────────────────────────────────────────────────────────────────────────
+# ── FALLBACK ──────────────────────────────────────────────────────────────────────────────────
 # ==============================================================================================
 
 # ━━━ DDNS ━━━