fix(backend): pass YouTube cookies to yt-dlp to beat the datacenter bot check

YouTube now returns "Sign in to confirm you're not a bot" for yt-dlp from
datacenter IPs, blocking downloads, search and link-resolve. When a cookies file
is present (YTDLP_COOKIES, default /data/youtube-cookies.txt) every yt-dlp call
passes --cookies so it authenticates. Checked at call time (drop the file in, no
code change); absent → unchanged behaviour. Applied to the download cascade, the
YTM search probe, and the importer resolve.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/lib/config.js

@@ -1,13 +1,21 @@
+const path = require('path');
+
+const dataPath = process.env.DATA_PATH || '/data';
+
 const CONFIG = {
   port:            process.env.PORT             || 3700,
   musicPath:       process.env.MUSIC_PATH       || '/music',
-  dataPath:        process.env.DATA_PATH        || '/data',
+  dataPath,
   ytdlpBin:        process.env.YTDLP_BIN       || 'yt-dlp',
   audioFmt:        process.env.AUDIO_FMT       || 'mp3',
   audioQuality:    process.env.AUDIO_QUALITY   || '0',
   maxParallel:     parseInt(process.env.MAX_PARALLEL || '2', 10),
   downloadBackend: (process.env.DOWNLOAD_BACKEND || 'ytdlp').toLowerCase(),
   ticketmasterKey:     process.env.TICKETMASTER_API_KEY  || '',
+  // YouTube bot-blocks datacenter IPs ("Sign in to confirm you're not a bot"). Passing cookies from
+  // a logged-in (ideally throwaway) account fixes it. Drop a Netscape-format cookies.txt at this path
+  // (default: in the data volume) and every yt-dlp call uses it. No file → yt-dlp runs as before.
+  cookiesFile:     process.env.YTDLP_COOKIES   || path.join(dataPath, 'youtube-cookies.txt'),
 };
 
 module.exports = CONFIG;

backend/lib/ytdlp.js

@@ -134,6 +134,12 @@ async function downloadTrack({ jobId, artist, rawArtist, albumArtist, title, alb
   // YTM ranking toward a same-named artist's full discography.
   const query = `${ytmArtist} ${searchTitle}`;
 
+  // YouTube bot-blocks datacenter IPs ("Sign in to confirm you're not a bot"). If a cookies file is
+  // present, pass it so yt-dlp authenticates. Checked at call time so dropping the file in takes
+  // effect without a code change; absent → no flag → unchanged behaviour.
+  const cookieArgs = () =>
+    (CONFIG.cookiesFile && fs.existsSync(CONFIG.cookiesFile)) ? ['--cookies', CONFIG.cookiesFile] : [];
+
   const baseArgs = [
     '--extract-audio',
     '--audio-format',   CONFIG.audioFmt,
@@ -148,6 +154,7 @@ async function downloadTrack({ jobId, artist, rawArtist, albumArtist, title, alb
     // "Art Track" / topic uploads are reachable. The android_vr client returns
     // "This video is not available" for many YTM tracks that play fine in the browser.
     '--extractor-args', 'youtube:player_client=web_music,default',
+    ...cookieArgs(),
   ];
 
   const spawnYtdlp = (args) => new Promise((resolve, reject) => {
@@ -217,6 +224,7 @@ async function downloadTrack({ jobId, artist, rawArtist, albumArtist, title, alb
       // generic YouTube search and returns unrelated videos instead of the
       // native Songs shelf (where the actual artist track lives).
       '--extractor-args', 'youtube:player_client=web_music,default',
+      ...cookieArgs(),
     ], { env: { ...process.env, PYTHONUNBUFFERED: '1' } });
     proc.stdout.on('data', d => {
       const text = d.toString();