feat(downloads): automatic PO-token provider (bgutil sidecar) to beat YouTube bot-detection

YouTube increasingly demands a Proof-of-Origin token (or shows 'confirm you're not a bot').
Instead of manual cookies, run the bgutil POT provider as a sidecar that mints tokens on demand:
- compose: bgutil-pot service (brainicism/bgutil-ytdlp-pot-provider:1.3.1, port 4416, init)
- requirements: bgutil-ytdlp-pot-provider==1.3.1 plugin (version pinned to the image)
- config: DOWNLOAD_POT_BASE_URL (http://bgutil-pot:4416) + DOWNLOAD_PLAYER_CLIENTS
  (web_safari,web,tv — POT-capable; the default android_vr client never requests a token)
- formats.build_ydl_opts wires extractor_args youtube:player_client + youtubepot-bgutilhttp:base_url

Verified: the sidecar mints a valid PO token (BotGuard challenge solved) and yt-dlp fetches it
from the provider. NOTE: end-to-end download couldn't be confirmed here because the test IP got
hard-flagged by YouTube from heavy testing (~16 GB + dozens of extractions) — a hard abuse block
needs cooldown/cookies, which POT doesn't lift; POT bypasses the normal soft bot-check.

backend/requirements.txt

@@ -16,4 +16,8 @@ argon2-cffi>=23.1,<26
 # Download center: yt-dlp does the extraction/download; ffmpeg (installed at the OS level in
 # the Dockerfile) does the merge + postprocessing. yt-dlp is release-often (YouTube changes),
 # so keep the floor loose and bump it when extraction breaks.
-yt-dlp>=2025.1
+yt-dlp>=2025.5.22
+# PO Token provider plugin: talks to the bgutil sidecar (brainicism/bgutil-ytdlp-pot-provider)
+# to mint YouTube Proof-of-Origin tokens on demand, bypassing "confirm you're not a bot" and
+# unlocking high-quality formats. Pin to match the sidecar image tag (versions must align).
+bgutil-ytdlp-pot-provider==1.3.1