fix(backend): pass YouTube cookies to yt-dlp to beat the datacenter bot check

YouTube now returns "Sign in to confirm you're not a bot" for yt-dlp from
datacenter IPs, blocking downloads, search and link-resolve. When a cookies file
is present (YTDLP_COOKIES, default /data/youtube-cookies.txt) every yt-dlp call
passes --cookies so it authenticates. Checked at call time (drop the file in, no
code change); absent → unchanged behaviour. Applied to the download cascade, the
YTM search probe, and the importer resolve.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/lib/ytdlp.js

@@ -134,6 +134,12 @@ async function downloadTrack({ jobId, artist, rawArtist, albumArtist, title, alb
   // YTM ranking toward a same-named artist's full discography.
   const query = `${ytmArtist} ${searchTitle}`;
 
+  // YouTube bot-blocks datacenter IPs ("Sign in to confirm you're not a bot"). If a cookies file is
+  // present, pass it so yt-dlp authenticates. Checked at call time so dropping the file in takes
+  // effect without a code change; absent → no flag → unchanged behaviour.
+  const cookieArgs = () =>
+    (CONFIG.cookiesFile && fs.existsSync(CONFIG.cookiesFile)) ? ['--cookies', CONFIG.cookiesFile] : [];
+
   const baseArgs = [
     '--extract-audio',
     '--audio-format',   CONFIG.audioFmt,
@@ -148,6 +154,7 @@ async function downloadTrack({ jobId, artist, rawArtist, albumArtist, title, alb
     // "Art Track" / topic uploads are reachable. The android_vr client returns
     // "This video is not available" for many YTM tracks that play fine in the browser.
     '--extractor-args', 'youtube:player_client=web_music,default',
+    ...cookieArgs(),
   ];
 
   const spawnYtdlp = (args) => new Promise((resolve, reject) => {
@@ -217,6 +224,7 @@ async function downloadTrack({ jobId, artist, rawArtist, albumArtist, title, alb
       // generic YouTube search and returns unrelated videos instead of the
       // native Songs shelf (where the actual artist track lives).
       '--extractor-args', 'youtube:player_client=web_music,default',
+      ...cookieArgs(),
     ], { env: { ...process.env, PYTHONUNBUFFERED: '1' } });
     proc.stdout.on('data', d => {
       const text = d.toString();