feat(downloads): automatic PO-token provider (bgutil sidecar) to beat YouTube bot-detection

YouTube increasingly demands a Proof-of-Origin token (or shows 'confirm you're not a bot').
Instead of manual cookies, run the bgutil POT provider as a sidecar that mints tokens on demand:
- compose: bgutil-pot service (brainicism/bgutil-ytdlp-pot-provider:1.3.1, port 4416, init)
- requirements: bgutil-ytdlp-pot-provider==1.3.1 plugin (version pinned to the image)
- config: DOWNLOAD_POT_BASE_URL (http://bgutil-pot:4416) + DOWNLOAD_PLAYER_CLIENTS
  (web_safari,web,tv — POT-capable; the default android_vr client never requests a token)
- formats.build_ydl_opts wires extractor_args youtube:player_client + youtubepot-bgutilhttp:base_url

Verified: the sidecar mints a valid PO token (BotGuard challenge solved) and yt-dlp fetches it
from the provider. NOTE: end-to-end download couldn't be confirmed here because the test IP got
hard-flagged by YouTube from heavy testing (~16 GB + dozens of extractions) — a hard abuse block
needs cooldown/cookies, which POT doesn't lift; POT bypasses the normal soft bot-check.

backend/app/worker.py

@@ -293,7 +293,13 @@ def _download(job_id: int, asset_id: int, source_kind: str, source_ref: str, spe
         staging.mkdir(parents=True, exist_ok=True)
 
         outtmpl = str(staging / "%(id)s.%(ext)s")
-        opts = formats.build_ydl_opts(spec, outtmpl, _make_progress_hook(job_id, asset_id))
+        opts = formats.build_ydl_opts(
+            spec,
+            outtmpl,
+            _make_progress_hook(job_id, asset_id),
+            settings.download_pot_base_url,
+            settings.player_client_list,
+        )
         opts["postprocessor_hooks"] = [_make_pp_hook(job_id)]
         url = service.source_url(source_kind, source_ref)