feat(backend): PO token provider for YouTube downloads; drop the cookies approach

Replace the cookies-file stopgap (needs a throwaway account + manual refresh)
with a self-hosted PO token provider — the cookie-less way past YouTube's
datacenter-IP block (bot check + media 403).

- docker-compose: new bgutil-provider service (brainicism/bgutil-ytdlp-pot-provider)
  + install the bgutil-ytdlp-pot-provider plugin in the backend + POT_PROVIDER_URL
  env + depends_on.
- ytdlp.js / server.js: when POT_PROVIDER_URL is set, pass
  --extractor-args youtubepot-bgutilhttp:base_url=... to the download cascade, the
  YTM search probe and the importer resolve. Empty → omitted (unchanged behaviour).
- Removed the cookiesFile config + --cookies wiring so there's no dead code.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/lib/config.js

@@ -1,21 +1,18 @@
-const path = require('path');
-
-const dataPath = process.env.DATA_PATH || '/data';
-
 const CONFIG = {
   port:            process.env.PORT             || 3700,
   musicPath:       process.env.MUSIC_PATH       || '/music',
-  dataPath,
+  dataPath:        process.env.DATA_PATH        || '/data',
   ytdlpBin:        process.env.YTDLP_BIN       || 'yt-dlp',
   audioFmt:        process.env.AUDIO_FMT       || 'mp3',
   audioQuality:    process.env.AUDIO_QUALITY   || '0',
   maxParallel:     parseInt(process.env.MAX_PARALLEL || '2', 10),
   downloadBackend: (process.env.DOWNLOAD_BACKEND || 'ytdlp').toLowerCase(),
   ticketmasterKey:     process.env.TICKETMASTER_API_KEY  || '',
-  // YouTube bot-blocks datacenter IPs ("Sign in to confirm you're not a bot"). Passing cookies from
-  // a logged-in (ideally throwaway) account fixes it. Drop a Netscape-format cookies.txt at this path
-  // (default: in the data volume) and every yt-dlp call uses it. No file → yt-dlp runs as before.
-  cookiesFile:     process.env.YTDLP_COOKIES   || path.join(dataPath, 'youtube-cookies.txt'),
+  // YouTube 403s media downloads from datacenter IPs without a PO ("Proof of Origin") token, which
+  // yt-dlp can't compute itself. The bgutil-ytdlp-pot-provider plugin fetches tokens from a small
+  // provider service; set its URL here (e.g. http://bgutil-provider:4416). Empty → no PO token used
+  // (yt-dlp runs exactly as before). See docker-compose.yml.
+  potProviderUrl:  process.env.POT_PROVIDER_URL || '',
 };
 
 module.exports = CONFIG;