feat(m5b): optional YouTube write scope via incremental OAuth

Default login now requests read-only (youtube.readonly); write (unsubscribe,
later playlist export) is an explicit opt-in.

- auth.py: split READ_SCOPES / WRITE_SCOPES; new GET /auth/upgrade (incremental
  consent, prompt=consent); has_write_scope() helper
- /api/me exposes can_write
- youtube/client.py: delete_subscription (50 units, OAuth-only)
- DELETE /api/channels/{id}/subscription, gated on write scope (403 otherwise)
- UI: Settings - Account 'Playlist editing & YouTube export' enable button;
  per-channel 'Unsubscribe on YouTube' (with confirm) shown only when can_write

Browser-facing; develop/test locally until the public HTTPS login lands. Needs a
one-time Console step: add youtube.readonly to the OAuth consent screen scopes.

frontend/src/components/SettingsPanel.tsx

@@ -449,10 +449,34 @@ function Account({ me }: { me: Me }) {
           <div className="text-xs text-muted capitalize">{me.role}</div>
         </div>
       </div>
-      <p className="text-xs text-muted leading-relaxed">
-        Playlist editing &amp; YouTube export, and the admin approval queue, arrive in the next
-        phases of this milestone.
-      </p>
+      <div className="mt-1 pt-3 border-t border-border">
+        <div className="flex items-start justify-between gap-3">
+          <div className="min-w-0">
+            <div className="text-sm font-medium">Playlist editing &amp; YouTube export</div>
+            <p className="text-xs text-muted leading-relaxed mt-0.5">
+              {me.can_write
+                ? "Granted. You can unsubscribe from channels on YouTube (and export playlists once that ships). Subfeed only writes when you ask it to."
+                : "Subfeed is read-only by default — it can browse your subscriptions but not change your YouTube account. Enable this to unsubscribe from channels (and, later, export playlists). You'll re-consent with Google."}
+            </p>
+          </div>
+          {me.can_write ? (
+            <span className="shrink-0 text-[11px] px-2 py-1 rounded-full border border-accent/40 text-accent">
+              Enabled
+            </span>
+          ) : (
+            <Tooltip hint="Redirects to Google to grant YouTube write access (unsubscribe / export). You can keep using Subfeed read-only if you skip it.">
+              <button
+                onClick={() => {
+                  window.location.href = "/auth/upgrade";
+                }}
+                className="shrink-0 glass-card glass-hover px-3 py-1.5 rounded-xl text-sm transition"
+              >
+                Enable
+              </button>
+            </Tooltip>
+          )}
+        </div>
+      </div>
     </Section>
   );
 }