Fix multi-process crash and Safari userscript compatibility

[wozniakpawel]

Summary

Two bug fixes:

1. Fix test_key endpoint crash in multi-process mode

api_config_test_key() accesses current_app.stacks_worker.downloader without checking if stacks_worker is None. In production (multi-process mode via gunicorn), the worker runs in a separate process and stacks_worker is set to None on the Flask app. This causes:

Connection failed: 'NoneType' object has no attribute 'downloader'

whenever a user tests their Anna's Archive secret key in the settings UI. The fix adds a None guard — the worker cache update is only relevant in debug/single-process mode anyway.

2. Fix userscript silent failure on Safari (Userscripts extension)

Safari's Userscripts extension has a broken GM_xmlhttpRequest implementation — callbacks (onload, onerror, ontimeout) never fire, causing the script to hang silently. This means:

• Connection test in settings never completes ("Connecting..." forever)
• fetchSubdirectories() never resolves, blocking init()
• Download buttons never get injected
• Version check never completes

The fix changes apiRequest() to use fetch as the primary request method and fall back to GM_xmlhttpRequest only when fetch fails (e.g. CORS not available). This works on both Safari and Chrome/Firefox:

• Safari (Userscripts): fetch works when the server has CORS enabled (Flask-CORS is already included)
• Chrome/Firefox (Tampermonkey): fetch works with CORS, or falls back to GM_xmlhttpRequest for cross-origin requests without CORS

Note: for Safari users connecting to a remote server over HTTPS (e.g. via a Caddy reverse proxy), the server's CORS headers from Flask-CORS are sufficient — no additional CORS configuration is needed on the proxy.