feat(backend): PO token provider for YouTube downloads; drop the cookies approach

Replace the cookies-file stopgap (needs a throwaway account + manual refresh)
with a self-hosted PO token provider — the cookie-less way past YouTube's
datacenter-IP block (bot check + media 403).

- docker-compose: new bgutil-provider service (brainicism/bgutil-ytdlp-pot-provider)
  + install the bgutil-ytdlp-pot-provider plugin in the backend + POT_PROVIDER_URL
  env + depends_on.
- ytdlp.js / server.js: when POT_PROVIDER_URL is set, pass
  --extractor-args youtubepot-bgutilhttp:base_url=... to the download cascade, the
  YTM search probe and the importer resolve. Empty → omitted (unchanged behaviour).
- Removed the cookiesFile config + --cookies wiring so there's no dead code.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/novasonic-server.js

@@ -533,9 +533,8 @@ app.post('/api/youtube/resolve', async (req, res) => {
       execFile(CONFIG.ytdlpBin, [
         '--dump-json', '--flat-playlist', '--no-warnings',
         '--playlist-items', '1-50',
-        // Cookies (if present) let yt-dlp past YouTube's datacenter-IP bot check. Domain-scoped, so
-        // harmless for non-YouTube links. No file → runs as before.
-        ...((CONFIG.cookiesFile && fs.existsSync(CONFIG.cookiesFile)) ? ['--cookies', CONFIG.cookiesFile] : []),
+        // PO token provider (if configured) to get past YouTube's datacenter-IP block. Empty → omitted.
+        ...(CONFIG.potProviderUrl ? ['--extractor-args', `youtubepot-bgutilhttp:base_url=${CONFIG.potProviderUrl}`] : []),
         url,
       ], { timeout: 45000, maxBuffer: 20 * 1024 * 1024 }, (err, out, stderr) => {
         if (err && !out?.trim()) return reject(new Error(stderr?.trim() || err.message));