feat(QBittorrent): port API-key auth from Radarr/Sonarr

[csmarshall]

Summary

Port qBittorrent's API-key authentication support (introduced in qBittorrent 5.x) from Radarr and Sonarr to bookshelf. Adds an ApiKey field to the qBit download-client settings; when populated, requests carry an Authorization: Bearer <key> header and the cookie-auth flow is bypassed entirely.

Existing username/password configurations see no behavior change.

Why

qBittorrent 5.x added API tokens as a more secure / scriptable alternative to user passwords. Radarr (source) and Sonarr both support it; bookshelf is the odd one out among the *arrs. Users running modern qBit who'd prefer API-key auth currently can't.

Changes

QBittorrentSettings.cs

• New ApiKey field at FieldDefinition(4), with PrivacyLevel.ApiKey so it's masked in the UI and exported configs.
• Validator rejects configurations where ApiKey is set alongside Username or Password, mirroring Radarr's rule.
• Renumber existing FieldDefinition order numbers (5..14) to slot the API Key field right above Username/Password where users naturally look for it. Property names are unchanged — stored configs are unaffected.

QBittorrentProxyV2.cs

• BuildRequest emits Authorization: Bearer <key> when ApiKey is set and only attaches BasicNetworkCredential when falling back to username/password.
• ProcessRequest gains a fast path for the ApiKey case that skips AuthenticateClient (no cookie session needed) and routes 401/403 directly to DownloadClientAuthenticationException, matching the Radarr/Sonarr pattern.

Independent of #162

This PR is intentionally orthogonal to #162 (the auth-response-handling fix). It builds and works whether or not #162 has landed:

• ApiKey users follow a fast path that doesn't touch the Content != "Ok." check at all.
• Username/password users on this branch alone hit the unchanged legacy code path, which still has the empty-body bug fix(QBittorrentProxyV2): accept empty body as auth success (qBit >= 4.5) #162 fixes. Once both PRs land they're additive.

Test plan

• Cross-checked the patch against Radarr's and Sonarr's QBittorrentSettings.cs + QBittorrentProxyV2.cs for behavioral parity.
• Stored configs preserved (FieldDefinition numbers are display-order only; property names are unchanged).
• Built locally: dotnet build NzbDrone.Core/Readarr.Core.csproj -c Release clean — 0 warnings, 0 errors.
• CI to verify build + existing tests.

Out of scope

Other divergences between bookshelf's and Radarr/Sonarr's qBit clients (the AddTags() method, base-class refactor to DownloadClientSettingsBase, translation-key labels, etc.) are deliberately not part of this PR — kept tight to the API-key feature so it's easy to review and accept.