feat(downloads): Deno JS runtime + web/android clients to complete the POT setup

The web player clients need two things beyond the PO token: (1) a JavaScript runtime for
YouTube's 'n' signature challenge — install Deno (v2.9.1) + yt-dlp[default] (bundles yt-dlp-ejs
solver scripts); auto-detected on PATH. (2) an audio source — the web clients only expose
video-only DASH, so add the 'android' client (also PO-token-backed) for audio/muxed formats.
Player clients: web_safari,web,android (dropped tv — it falsely reports normal videos as DRM).

End-to-end verified in the worker: extraction (POT + Deno n-challenge) + download completes,
no bot/DRM/format errors. Full YouTube stack now: force-ipv4 + bgutil POT sidecar + Deno.

Dockerfile

@@ -34,10 +34,16 @@ ENV PYTHONDONTWRITEBYTECODE=1 \
 
 WORKDIR /app
 
-# ffmpeg is required by the download center (yt-dlp) to merge separate video+audio streams
-# and run postprocessing (audio extract, embed thumbnail/chapters/subs, SponsorBlock).
+# ffmpeg: merge separate video+audio streams + postprocessing. Deno: the JavaScript runtime
+# yt-dlp uses to solve YouTube's "n" signature challenge for the web player clients (required
+# alongside the PO token, else only storyboards are offered). yt-dlp auto-detects deno on PATH.
+ARG DENO_VERSION=v2.9.1
 RUN apt-get update \
-    && apt-get install -y --no-install-recommends ffmpeg \
+    && apt-get install -y --no-install-recommends ffmpeg unzip curl ca-certificates \
+    && curl -fsSL "https://github.com/denoland/deno/releases/download/${DENO_VERSION}/deno-x86_64-unknown-linux-gnu.zip" -o /tmp/deno.zip \
+    && unzip -o /tmp/deno.zip -d /usr/local/bin \
+    && chmod +x /usr/local/bin/deno \
+    && rm /tmp/deno.zip \
     && rm -rf /var/lib/apt/lists/*
 
 COPY backend/requirements.txt .