fix(backend): download via default client (web_music media 403s); add optional proxy

The PO token provider works (web_music gets a token) but web_music's media URLs
still 403 from a datacenter IP. Prefer the default player clients for the
DOWNLOAD (their URLs go through with a PO token), keeping web_music only as a
fallback for Art-Track extraction; the YTM search still leads with web_music.

Also add an optional YTDLP_PROXY (--proxy) — the durable fix if the IP stays
flagged (403/429) even with a PO token. Empty → unchanged.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/lib/ytdlp.js

@@ -142,6 +142,10 @@ async function downloadTrack({ jobId, artist, rawArtist, albumArtist, title, alb
       ? ['--extractor-args', `youtubepot-bgutilhttp:base_url=${CONFIG.potProviderUrl}`]
       : [];
 
+  // Optional proxy — the durable fix when a datacenter IP stays flagged (403/429) even with a PO
+  // token. Route yt-dlp through a residential/rotating proxy via YTDLP_PROXY. Empty → not used.
+  const proxyArgs = () => (CONFIG.ytdlpProxy ? ['--proxy', CONFIG.ytdlpProxy] : []);
+
   const baseArgs = [
     '--extract-audio',
     '--audio-format',   CONFIG.audioFmt,
@@ -152,11 +156,13 @@ async function downloadTrack({ jobId, artist, rawArtist, albumArtist, title, alb
     '--newline',
     // Hard upper size limit — prevents saving a wrong 28-min video as a ~52 MB mp3
     '--max-filesize',   '30M',
-    // Use the web_music player client (falling back to default) so YouTube Music
-    // "Art Track" / topic uploads are reachable. The android_vr client returns
-    // "This video is not available" for many YTM tracks that play fine in the browser.
-    '--extractor-args', 'youtube:player_client=web_music,default',
+    // For the DOWNLOAD, prefer the default clients (their media URLs go through with a PO token from
+    // a datacenter IP) and keep web_music only as a fallback for Art Tracks that only it can extract.
+    // web_music's own media URLs 403 from datacenter IPs even with a valid PO token. (The YTM *search*
+    // in getYtmVideoUrls still leads with web_music, which is where Art-Track discovery matters.)
+    '--extractor-args', 'youtube:player_client=default,web_music',
     ...potArgs(),
+    ...proxyArgs(),
   ];
 
   const spawnYtdlp = (args) => new Promise((resolve, reject) => {
@@ -230,6 +236,7 @@ async function downloadTrack({ jobId, artist, rawArtist, albumArtist, title, alb
       // native Songs shelf (where the actual artist track lives).
       '--extractor-args', 'youtube:player_client=web_music,default',
       ...potArgs(),
+      ...proxyArgs(),
     ], { env: { ...process.env, PYTHONUNBUFFERED: '1' } });
     proc.stdout.on('data', d => {
       const text = d.toString();