feat(backend): PO token provider for YouTube downloads; drop the cookies approach

Replace the cookies-file stopgap (needs a throwaway account + manual refresh)
with a self-hosted PO token provider — the cookie-less way past YouTube's
datacenter-IP block (bot check + media 403).

- docker-compose: new bgutil-provider service (brainicism/bgutil-ytdlp-pot-provider)
  + install the bgutil-ytdlp-pot-provider plugin in the backend + POT_PROVIDER_URL
  env + depends_on.
- ytdlp.js / server.js: when POT_PROVIDER_URL is set, pass
  --extractor-args youtubepot-bgutilhttp:base_url=... to the download cascade, the
  YTM search probe and the importer resolve. Empty → omitted (unchanged behaviour).
- Removed the cookiesFile config + --cookies wiring so there's no dead code.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docker-compose.yml

@@ -33,15 +33,28 @@ services:
       - MAX_PARALLEL=${MAX_PARALLEL:-2}
       - DOWNLOAD_BACKEND=${DOWNLOAD_BACKEND:-ytdlp}
       - TICKETMASTER_API_KEY=${TICKETMASTER_API_KEY}
+      # PO token provider (bgutil) — lets yt-dlp download from datacenter IPs without cookies/account.
+      - POT_PROVIDER_URL=http://bgutil-provider:4416
+    depends_on:
+      - bgutil-provider
     command: >
       sh -c "
         apt-get update && apt-get install -y --no-install-recommends python3 python3-pip ffmpeg curl git && rm -rf /var/lib/apt/lists/* &&
         curl -sL https://github.com/yt-dlp/yt-dlp/releases/latest/download/yt-dlp -o /usr/local/bin/yt-dlp && chmod a+rx /usr/local/bin/yt-dlp &&
-        pip install --break-system-packages spotapi 'git+https://github.com/TzurSoffer/spotify-downloader' &&
+        pip install --break-system-packages spotapi 'git+https://github.com/TzurSoffer/spotify-downloader' bgutil-ytdlp-pot-provider &&
         mkdir -p /deps && cd /deps && npm install express kuromoji &&
         cd /app && NODE_PATH=/deps/node_modules node novasonic-server.js
       "
 
+  # ── PO token provider (bgutil) — mints YouTube "Proof of Origin" tokens so yt-dlp can download
+  #    from a datacenter IP without cookies or an account. Paired with the bgutil-ytdlp-pot-provider
+  #    plugin installed in the backend above. Port 4416 is internal only (no reverse proxy needed). ──
+  bgutil-provider:
+    image: brainicism/bgutil-ytdlp-pot-provider:latest
+    container_name: bgutil-provider
+    restart: unless-stopped
+    init: true
+
   # ── Scrobble service (isolated timestamped play-log → stats + Wrapped) ────────
   novasonic-scrobble:
     image: node:22-slim