refactor: comprehensive audit remediation across codebase

[calmcacil]

Summary

Remediation of 33 findings from a comprehensive codebase audit, spanning security, code quality, correctness, terminal/UI, and testing.

Changes

Security

• Support PLEX_TOKEN, JELLYFIN_TOKEN, OVERSEERR_API_KEY env vars for API tokens

Code Quality

• Rename internal/http → internal/httputil (avoids net/http shadow)
• Eliminate 19 duplicated clr closures → colors.ClrFunc() helper
• Remove ctx from ToolConfig struct, pass context.Context explicitly
• Standardize JSONOutput field name across feed and other tools
• Add .golangci.yml linter configuration

Terminal/UI

• Replace emoji with text alternatives
• Fix clearScreen() to actually clear terminal
• Replace os.Exit(1) with return in watch mode for proper cursor restore
• Route 4 diagnostic messages from stdout to stderr

Correctness

• Simplify allFailed() switch in streams.go
• Add deduplication by ID in feed watch mode event cache
• Accept config version >= 1 instead of requiring exactly 1
• Add theme validation with colors.ValidateTheme()
• Define constants for magic number label widths

Testing

• Add 5 cmd/*_test.go files (one per CLI tool, previously untested)
• Add httputil/client_test.go with comprehensive HTTP tests
• Add colors/colors_test.go with palette and helper tests
• Add TokenFromEnv test in config_test.go
• All 12 packages now pass go test -race -count=1

Build

• Add make fmt target

Verification

• go build ./... — passes
• go vet ./... — passes
• go test -race -count=1 ./... — all 12 packages pass
• gofmt -l . — empty (all formatted)