feat(config): move youtube_api_key to DB (encrypted, admin-editable)

Register youtube_api_key in the sysconfig registry as a secret and resolve it from
the DB-override-or-env layer in YouTubeClient (self.db is in scope). Adds a YouTube
API group to the Configuration page (EN/HU/DE).

Google OAuth client id/secret stay env-only for now: the authlib client is
registered at module load (auth.py), and the token-refresh reads them too, so a
runtime DB override needs a lazy/re-registerable OAuth client — that belongs to the
install-wizard epic (first-boot OAuth config without restart). Admin-role-via-UI
moves to the auth-overhaul epic (user management lives there).

frontend/src/i18n/locales/en/config.json

@@ -3,6 +3,7 @@
   "loading": "Loading configuration…",
   "groups": {
     "email": "Email / SMTP",
+    "youtube": "YouTube API",
     "quota": "Quota",
     "backfill": "Backfill",
     "shorts": "Shorts probe",
@@ -21,7 +22,8 @@
     "shorts_probe_max_seconds": { "label": "Shorts probe — max duration (s)", "hint": "Only videos at or below this length are probed as possible Shorts." },
     "shorts_probe_batch": { "label": "Shorts probe — batch size", "hint": "How many videos to classify per run." },
     "enrich_batch_size": { "label": "Enrichment batch size", "hint": "videos.list ids per call (YouTube caps this at 50)." },
-    "autotag_title_sample": { "label": "Auto-tag title sample", "hint": "Recent video titles sampled per channel for language detection." }
+    "autotag_title_sample": { "label": "Auto-tag title sample", "hint": "Recent video titles sampled per channel for language detection." },
+    "youtube_api_key": { "label": "YouTube API key", "hint": "Optional. Used for public reads (channels/videos) so shared backfill doesn't depend on a user's OAuth. Stored encrypted; write-only." }
   },
   "save": "Save",
   "saving": "Saving…",