fix: security hardening and HTTP status code corrections

- importSTRMHandler: add URL scheme validation (blocks file://, ftp://, etc.)
- backup Delete/Restore: harden path traversal check (block backslash, require .db extension)
- HTTP 201 for create endpoints: register, subscription, download client, notify channel, library, STRM import
- Error handling: return 500 for service/infra errors in download client and notify channel handlers

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

internal/handler/subscriptions.go

@@ -81,7 +81,7 @@ func createSubscriptionHandler(svc *service.Container) gin.HandlerFunc {
 		enriched := []model.Subscription{*s}
 		service.EnrichSubscriptionProgress(c.Request.Context(), svc.Repo, enriched)
 		*s = enriched[0]
-		c.JSON(http.StatusOK, s)
+		c.JSON(http.StatusCreated, s)
 	}
 }