fix(proxy): drop client Referer and Origin before forwarding to qBittorrent

Description

The client proxy copied the calling app's Referer and Origin headers onto the request it sends to qBittorrent. qBittorrent's WebUI CSRF check answers 401 when either header names a host other than its own, so an app that sends a Referer (the BookOrbit "Test connection" button, for example) could not use a client proxy URL, while apps that send none (Lidarr) worked.

rewriteRequest now deletes both headers from the outbound request, right after applyAuthHeaders. qui is the qBittorrent client here and its own API calls send neither header, so proxied calls now look the same to qBittorrent. RetryTransport clones that outbound request for every attempt, so a request replayed after a session refresh also goes out without them.

TestProxyDropsClientRefererAndOrigin sends requests through the handler to a test upstream that returns 401 on any Referer or Origin. It covers a Referer, a foreign Origin, no header, and a Referer on a request that gets the 403 of an expired session and is replayed after re-login. On develop the three header cases fail with 401.

Fixes #3167

How has this been tested?

No live run against a real qBittorrent instance. The closest check is the handler test above, whose upstream rejects the headers the way the CSRF check does.

Performance

No performance risk. Two header deletes per proxied request, no new allocations or I/O.

Checklist

• My PR title follows the Conventional Commits format (it becomes the squashed commit message)
• If this changes the database schema, I have added migrations for both SQLite and PostgreSQL
• I completed the mandatory performance checks and recorded the outcome in Performance

AI disclosure

Yes. The fix and test were written with Claude Code (Claude Opus) from the issue brief. I confirmed the new test fails without the fix, and ran go test -count=1 ./internal/proxy/, go vet and golangci-lint on the package.