fix(backend): download via default client (web_music media 403s); add optional proxy

The PO token provider works (web_music gets a token) but web_music's media URLs
still 403 from a datacenter IP. Prefer the default player clients for the
DOWNLOAD (their URLs go through with a PO token), keeping web_music only as a
fallback for Art-Track extraction; the YTM search still leads with web_music.

Also add an optional YTDLP_PROXY (--proxy) — the durable fix if the IP stays
flagged (403/429) even with a PO token. Empty → unchanged.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/lib/config.js

@@ -13,6 +13,9 @@ const CONFIG = {
   // provider service; set its URL here (e.g. http://bgutil-provider:4416). Empty → no PO token used
   // (yt-dlp runs exactly as before). See docker-compose.yml.
   potProviderUrl:  process.env.POT_PROVIDER_URL || '',
+  // Optional proxy for yt-dlp (e.g. a residential/rotating proxy) — the durable fix when the
+  // datacenter IP stays flagged (403/429) even with a PO token. Empty → yt-dlp runs directly.
+  ytdlpProxy:      process.env.YTDLP_PROXY || '',
 };
 
 module.exports = CONFIG;