feat(backend): PO token provider for YouTube downloads; drop the cookies approach

Replace the cookies-file stopgap (needs a throwaway account + manual refresh)
with a self-hosted PO token provider — the cookie-less way past YouTube's
datacenter-IP block (bot check + media 403).

- docker-compose: new bgutil-provider service (brainicism/bgutil-ytdlp-pot-provider)
  + install the bgutil-ytdlp-pot-provider plugin in the backend + POT_PROVIDER_URL
  env + depends_on.
- ytdlp.js / server.js: when POT_PROVIDER_URL is set, pass
  --extractor-args youtubepot-bgutilhttp:base_url=... to the download cascade, the
  YTM search probe and the importer resolve. Empty → omitted (unchanged behaviour).
- Removed the cookiesFile config + --cookies wiring so there's no dead code.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/lib/config.js

@@ -1,21 +1,18 @@
-const path = require('path');
-
-const dataPath = process.env.DATA_PATH || '/data';
-
 const CONFIG = {
   port:            process.env.PORT             || 3700,
   musicPath:       process.env.MUSIC_PATH       || '/music',
-  dataPath,
+  dataPath:        process.env.DATA_PATH        || '/data',
   ytdlpBin:        process.env.YTDLP_BIN       || 'yt-dlp',
   audioFmt:        process.env.AUDIO_FMT       || 'mp3',
   audioQuality:    process.env.AUDIO_QUALITY   || '0',
   maxParallel:     parseInt(process.env.MAX_PARALLEL || '2', 10),
   downloadBackend: (process.env.DOWNLOAD_BACKEND || 'ytdlp').toLowerCase(),
   ticketmasterKey:     process.env.TICKETMASTER_API_KEY  || '',
-  // YouTube bot-blocks datacenter IPs ("Sign in to confirm you're not a bot"). Passing cookies from
-  // a logged-in (ideally throwaway) account fixes it. Drop a Netscape-format cookies.txt at this path
-  // (default: in the data volume) and every yt-dlp call uses it. No file → yt-dlp runs as before.
-  cookiesFile:     process.env.YTDLP_COOKIES   || path.join(dataPath, 'youtube-cookies.txt'),
+  // YouTube 403s media downloads from datacenter IPs without a PO ("Proof of Origin") token, which
+  // yt-dlp can't compute itself. The bgutil-ytdlp-pot-provider plugin fetches tokens from a small
+  // provider service; set its URL here (e.g. http://bgutil-provider:4416). Empty → no PO token used
+  // (yt-dlp runs exactly as before). See docker-compose.yml.
+  potProviderUrl:  process.env.POT_PROVIDER_URL || '',
 };
 
 module.exports = CONFIG;

backend/lib/ytdlp.js

@@ -134,11 +134,13 @@ async function downloadTrack({ jobId, artist, rawArtist, albumArtist, title, alb
   // YTM ranking toward a same-named artist's full discography.
   const query = `${ytmArtist} ${searchTitle}`;
 
-  // YouTube bot-blocks datacenter IPs ("Sign in to confirm you're not a bot"). If a cookies file is
-  // present, pass it so yt-dlp authenticates. Checked at call time so dropping the file in takes
-  // effect without a code change; absent → no flag → unchanged behaviour.
-  const cookieArgs = () =>
-    (CONFIG.cookiesFile && fs.existsSync(CONFIG.cookiesFile)) ? ['--cookies', CONFIG.cookiesFile] : [];
+  // YouTube 403s media downloads from datacenter IPs without a PO token. When a provider URL is
+  // configured, point the bgutil-ytdlp-pot-provider plugin at it so yt-dlp fetches a token. Empty
+  // config → no arg → unchanged behaviour.
+  const potArgs = () =>
+    CONFIG.potProviderUrl
+      ? ['--extractor-args', `youtubepot-bgutilhttp:base_url=${CONFIG.potProviderUrl}`]
+      : [];
 
   const baseArgs = [
     '--extract-audio',
@@ -154,7 +156,7 @@ async function downloadTrack({ jobId, artist, rawArtist, albumArtist, title, alb
     // "Art Track" / topic uploads are reachable. The android_vr client returns
     // "This video is not available" for many YTM tracks that play fine in the browser.
     '--extractor-args', 'youtube:player_client=web_music,default',
-    ...cookieArgs(),
+    ...potArgs(),
   ];
 
   const spawnYtdlp = (args) => new Promise((resolve, reject) => {
@@ -227,7 +229,7 @@ async function downloadTrack({ jobId, artist, rawArtist, albumArtist, title, alb
       // generic YouTube search and returns unrelated videos instead of the
       // native Songs shelf (where the actual artist track lives).
       '--extractor-args', 'youtube:player_client=web_music,default',
-      ...cookieArgs(),
+      ...potArgs(),
     ], { env: { ...process.env, PYTHONUNBUFFERED: '1' } });
     proc.stdout.on('data', d => {
       const text = d.toString();

backend/novasonic-server.js

@@ -533,9 +533,8 @@ app.post('/api/youtube/resolve', async (req, res) => {
       execFile(CONFIG.ytdlpBin, [
         '--dump-json', '--flat-playlist', '--no-warnings',
         '--playlist-items', '1-50',
-        // Cookies (if present) let yt-dlp past YouTube's datacenter-IP bot check. Domain-scoped, so
-        // harmless for non-YouTube links. No file → runs as before.
-        ...((CONFIG.cookiesFile && fs.existsSync(CONFIG.cookiesFile)) ? ['--cookies', CONFIG.cookiesFile] : []),
+        // PO token provider (if configured) to get past YouTube's datacenter-IP block. Empty → omitted.
+        ...(CONFIG.potProviderUrl ? ['--extractor-args', `youtubepot-bgutilhttp:base_url=${CONFIG.potProviderUrl}`] : []),
         url,
       ], { timeout: 45000, maxBuffer: 20 * 1024 * 1024 }, (err, out, stderr) => {
         if (err && !out?.trim()) return reject(new Error(stderr?.trim() || err.message));