feat(torrent): act as WebTorrent peer for browser ↔ unarr P2P streaming

Wires anacrolix/torrent's built-in webtorrent package so a browser
running webtorrent.js can fetch pieces from this CLI via WebRTC data
channels. The daemon stays the seeder; we never relay bytes through
TorrentClaw infrastructure — same legal posture as today.

Changes:
- internal/config: new [downloads.webrtc] section
  (enabled/trackers/stun_servers/turn_servers/turn_user/turn_pass).
  Disabled by default, opt-in via config.toml. When enabled but
  trackers / STUN slices are empty, defaults are reapplied on Load() so
  users get a working setup with a single `enabled = true`.
- internal/engine: TorrentConfig gains WebRTCEnabled / WebRTCTrackers
  / ICEServers; NewTorrentDownloader populates ClientConfig.ICEServerList
  and forces NoUpload=false when WebRTC is on (browsers can't pull
  otherwise). buildMagnet now accepts variadic extra trackers and the
  downloader method prepends WSS trackers so anacrolix's
  webtorrent.TrackerClient picks them up first.
- internal/engine/webrtc.go: BuildICEServers helper converts the TOML
  WebRTCConfig into []webrtc.ICEServer with shared TURN credentials.
- internal/cmd/daemon.go + download.go: pass WebRTC config through to
  the engine.

Tests (8 new, all green; full suite 0 lint issues, 0 vet):
- buildMagnet free function: defaults-only, with extras, trim+empty-skip
- downloader method: WebRTC disabled keeps WSS out, enabled prepends them
- BuildICEServers: nil when disabled, STUN-only path, TURN+credentials
- NewTorrentDownloader: full WebRTC-enabled construction (logs WebRTC
  peer enabled, magnet contains wss://tracker.torrentclaw.com)

End-to-end smoke (browser ↔ unarr peer transfer) is deferred to a
manual test once tracker.torrentclaw.com WSS is live.

internal/engine/webrtc.go

@@ -0,0 +1,36 @@
+package engine
+
+import (
+	"github.com/pion/webrtc/v4"
+	"github.com/torrentclaw/unarr/internal/config"
+)
+
+// BuildICEServers converts a config.WebRTCConfig into the
+// []webrtc.ICEServer slice that anacrolix/torrent's webtorrent client
+// needs. STUN entries become bare URLs; TURN entries inherit the shared
+// TURNUser / TURNPass credentials. Returns nil when WebRTC is disabled.
+func BuildICEServers(cfg config.WebRTCConfig) []webrtc.ICEServer {
+	if !cfg.Enabled {
+		return nil
+	}
+	var servers []webrtc.ICEServer
+	for _, s := range cfg.STUNServers {
+		if s == "" {
+			continue
+		}
+		servers = append(servers, webrtc.ICEServer{URLs: []string{s}})
+	}
+	for _, t := range cfg.TURNServers {
+		if t == "" {
+			continue
+		}
+		entry := webrtc.ICEServer{URLs: []string{t}}
+		if cfg.TURNUser != "" {
+			entry.Username = cfg.TURNUser
+			entry.Credential = cfg.TURNPass
+			entry.CredentialType = webrtc.ICECredentialTypePassword
+		}
+		servers = append(servers, entry)
+	}
+	return servers
+}