feat(opds): always send X-Bookhoard-SHA256 on native EPUB downloads

DownloadBook populated fileSha256 only for the kepub and pdf format
branches, so the default EPUB download never emitted the
X-Bookhoard-SHA256 response header - the hash was only available in
the feed metadata, not on the download response itself.

Populate it from mediaItem.FileSha256 in the default branch so every
download response carries the canonical primary-format hash. Clients
that capture response headers at download time now learn the hash
regardless of which format they requested.

internal/handlers/opds.go

@@ -605,6 +605,12 @@ func (h *OPDSHandler) DownloadBook(c *echo.Context) error {
 		if mediaItem.MimeType.Valid {
 			mimeType = mediaItem.MimeType.String
 		}
+		// Always expose the primary content hash so clients (e.g. the koreader
+		// plugin) learn the canonical SHA-256 from the download response itself,
+		// not just from the feed metadata.
+		if mediaItem.FileSha256.Valid {
+			fileSha256 = mediaItem.FileSha256.String
+		}
 	}
 
 	// Check if file exists