fix(backend): pass YouTube cookies to yt-dlp to beat the datacenter bot check

YouTube now returns "Sign in to confirm you're not a bot" for yt-dlp from
datacenter IPs, blocking downloads, search and link-resolve. When a cookies file
is present (YTDLP_COOKIES, default /data/youtube-cookies.txt) every yt-dlp call
passes --cookies so it authenticates. Checked at call time (drop the file in, no
code change); absent → unchanged behaviour. Applied to the download cascade, the
YTM search probe, and the importer resolve.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

CHANGELOG.md

@@ -88,6 +88,11 @@ to Android at parity with web, and fixes a batch of same-name-artist and player
   as avatar chips, matching the Android app (previously plain text).
 
 ### Fixed
+- **Downloads — YouTube bot check ("Sign in to confirm you're not a bot")** — YouTube now blocks
+  yt-dlp from datacenter IPs. The backend passes a **cookies file** to every yt-dlp call when present
+  (`YTDLP_COOKIES`, default `/data/youtube-cookies.txt`): drop a Netscape `cookies.txt` from a
+  logged-in (ideally throwaway) account into the data volume and downloads/search/resolve
+  authenticate again. Absent → yt-dlp runs exactly as before (no behaviour change).
 - **Artist pin — search & similar artists (Web + Android)** — a pinned artist now shows the correct
   Deezer photo in library search (not the wrong same-name person's), and its "Similar Artists" use
   Deezer's **related** for the pinned artist instead of Last.fm's list (which was keyed to the