fix(backend): pass YouTube cookies to yt-dlp to beat the datacenter bot check

YouTube now returns "Sign in to confirm you're not a bot" for yt-dlp from
datacenter IPs, blocking downloads, search and link-resolve. When a cookies file
is present (YTDLP_COOKIES, default /data/youtube-cookies.txt) every yt-dlp call
passes --cookies so it authenticates. Checked at call time (drop the file in, no
code change); absent → unchanged behaviour. Applied to the download cascade, the
YTM search probe, and the importer resolve.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/lib/config.js

@@ -1,13 +1,21 @@
+const path = require('path');
+
+const dataPath = process.env.DATA_PATH || '/data';
+
 const CONFIG = {
   port:            process.env.PORT             || 3700,
   musicPath:       process.env.MUSIC_PATH       || '/music',
-  dataPath:        process.env.DATA_PATH        || '/data',
+  dataPath,
   ytdlpBin:        process.env.YTDLP_BIN       || 'yt-dlp',
   audioFmt:        process.env.AUDIO_FMT       || 'mp3',
   audioQuality:    process.env.AUDIO_QUALITY   || '0',
   maxParallel:     parseInt(process.env.MAX_PARALLEL || '2', 10),
   downloadBackend: (process.env.DOWNLOAD_BACKEND || 'ytdlp').toLowerCase(),
   ticketmasterKey:     process.env.TICKETMASTER_API_KEY  || '',
+  // YouTube bot-blocks datacenter IPs ("Sign in to confirm you're not a bot"). Passing cookies from
+  // a logged-in (ideally throwaway) account fixes it. Drop a Netscape-format cookies.txt at this path
+  // (default: in the data volume) and every yt-dlp call uses it. No file → yt-dlp runs as before.
+  cookiesFile:     process.env.YTDLP_COOKIES   || path.join(dataPath, 'youtube-cookies.txt'),
 };
 
 module.exports = CONFIG;