The PO token provider works (web_music gets a token) but web_music's media URLs still 403 from a datacenter IP. Prefer the default player clients for the DOWNLOAD (their URLs go through with a PO token), keeping web_music only as a fallback for Art-Track extraction; the YTM search still leads with web_music. Also add an optional YTDLP_PROXY (--proxy) — the durable fix if the IP stays flagged (403/429) even with a PO token. Empty → unchanged. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>