feat(downloads): automatic PO-token provider (bgutil sidecar) to beat YouTube bot-detection

YouTube increasingly demands a Proof-of-Origin token (or shows 'confirm you're not a bot').
Instead of manual cookies, run the bgutil POT provider as a sidecar that mints tokens on demand:
- compose: bgutil-pot service (brainicism/bgutil-ytdlp-pot-provider:1.3.1, port 4416, init)
- requirements: bgutil-ytdlp-pot-provider==1.3.1 plugin (version pinned to the image)
- config: DOWNLOAD_POT_BASE_URL (http://bgutil-pot:4416) + DOWNLOAD_PLAYER_CLIENTS
  (web_safari,web,tv — POT-capable; the default android_vr client never requests a token)
- formats.build_ydl_opts wires extractor_args youtube:player_client + youtubepot-bgutilhttp:base_url

Verified: the sidecar mints a valid PO token (BotGuard challenge solved) and yt-dlp fetches it
from the provider. NOTE: end-to-end download couldn't be confirmed here because the test IP got
hard-flagged by YouTube from heavy testing (~16 GB + dozens of extractions) — a hard abuse block
needs cooldown/cookies, which POT doesn't lift; POT bypasses the normal soft bot-check.

docker-compose.localdev.yml

@@ -81,11 +81,23 @@ services:
     depends_on:
       db:
         condition: service_healthy
+      bgutil-pot:
+        condition: service_started
     security_opt:
       - apparmor:unconfined
     volumes:
       - ./downloads:/downloads
     restart: unless-stopped
 
+  # PO-token provider: mints YouTube Proof-of-Origin tokens on demand so the worker bypasses
+  # bot-detection and gets high-quality formats. The worker reaches it at http://bgutil-pot:4416
+  # (DOWNLOAD_POT_BASE_URL). Pin the tag to match the plugin version in requirements.txt.
+  bgutil-pot:
+    image: brainicism/bgutil-ytdlp-pot-provider:1.3.1
+    init: true
+    security_opt:
+      - apparmor:unconfined
+    restart: unless-stopped
+
 volumes:
   pgdata: