docs(changelog): split download fixes into [2.2] (PO token provider + false-success)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

CHANGELOG.md

@@ -64,6 +64,28 @@ Versioning: two-part `MAJOR.MINOR` — each release bumps the minor (features an
 
 ---
 
+## [2.2] — 2026-08-14
+
+Keeps downloads working after YouTube began blocking datacenter IPs, and fixes a related
+false-success in the UI.
+
+### Added
+- **PO token provider (bgutil)** — YouTube now 403s media downloads from datacenter IPs without a
+  **PO ("Proof of Origin") token** that yt-dlp can't compute itself (seen first as "Sign in to
+  confirm you're not a bot", then `HTTP 403` on the audio stream). A self-hosted **`bgutil-provider`**
+  container (`brainicism/bgutil-ytdlp-pot-provider`) mints the tokens and the matching
+  `bgutil-ytdlp-pot-provider` plugin (installed in the backend) hands them to yt-dlp — **no cookies or
+  account required**. Wired into the download cascade, the YTM search probe and the importer resolve,
+  guarded by `POT_PROVIDER_URL` (empty → yt-dlp runs exactly as before). Deploy: `docker compose up -d`.
+
+### Fixed
+- **A failed direct-link download reported success** — the direct-URL path returned `success` even
+  when no audio was produced (e.g. the YouTube 403), so the job showed "Fertig!" and the UI (web +
+  Android) said the track was added. It now reports failure with a clear message ("Download
+  fehlgeschlagen — YouTube hat den Abruf blockiert (403)").
+
+---
+
 ## [2.1] — 2026-08-14
 
 Builds on the 2.0 listening archive with a **head-to-head "Musik-Match"**, brings the **artist pin**
@@ -88,15 +110,6 @@ to Android at parity with web, and fixes a batch of same-name-artist and player
   as avatar chips, matching the Android app (previously plain text).
 
 ### Fixed
-- **Downloads — YouTube datacenter-IP block (bot check + media 403)** — YouTube now blocks yt-dlp
-  from datacenter IPs (first "Sign in to confirm you're not a bot", then `HTTP 403` on the media
-  stream, which needs a **PO token** yt-dlp can't compute itself). Added a **`bgutil-provider`**
-  service (Docker) + the `bgutil-ytdlp-pot-provider` plugin in the backend; yt-dlp fetches PO tokens
-  from it — no cookies or account needed. Guarded by `POT_PROVIDER_URL` (empty → yt-dlp runs exactly
-  as before). See `docker-compose.yml`.
-- **Downloads — a failed direct-link download reported success** — the direct-URL path returned
-  `success` even when no audio was produced (e.g. the YouTube 403), so the job showed "Fertig!" and
-  the UI (web + Android) said the track was added. It now reports failure with a clear message.
 - **Artist pin — search & similar artists (Web + Android)** — a pinned artist now shows the correct
   Deezer photo in library search (not the wrong same-name person's), and its "Similar Artists" use
   Deezer's **related** for the pinned artist instead of Last.fm's list (which was keyed to the