feat(config): move youtube_api_key to DB (encrypted, admin-editable)

Register youtube_api_key in the sysconfig registry as a secret and resolve it from
the DB-override-or-env layer in YouTubeClient (self.db is in scope). Adds a YouTube
API group to the Configuration page (EN/HU/DE).

Google OAuth client id/secret stay env-only for now: the authlib client is
registered at module load (auth.py), and the token-refresh reads them too, so a
runtime DB override needs a lazy/re-registerable OAuth client — that belongs to the
install-wizard epic (first-boot OAuth config without restart). Admin-role-via-UI
moves to the auth-overhaul epic (user management lives there).

backend/app/sysconfig.py

@@ -48,6 +48,8 @@ SPECS: tuple[ConfigSpec, ...] = (
     # --- Batch sizes ---
     ConfigSpec("enrich_batch_size", "int", "batch", "enrich_batch_size", min=1, max=50),
     ConfigSpec("autotag_title_sample", "int", "batch", "autotag_title_sample", min=1, max=1_000),
+    # --- YouTube Data API key (secret; optional — public reads prefer it over OAuth) ---
+    ConfigSpec("youtube_api_key", "str", "youtube", "youtube_api_key", secret=True),
 )
 
 _BY_KEY: dict[str, ConfigSpec] = {s.key: s for s in SPECS}