feat(m5b): optional YouTube write scope via incremental OAuth

Default login now requests read-only (youtube.readonly); write (unsubscribe,
later playlist export) is an explicit opt-in.

- auth.py: split READ_SCOPES / WRITE_SCOPES; new GET /auth/upgrade (incremental
  consent, prompt=consent); has_write_scope() helper
- /api/me exposes can_write
- youtube/client.py: delete_subscription (50 units, OAuth-only)
- DELETE /api/channels/{id}/subscription, gated on write scope (403 otherwise)
- UI: Settings - Account 'Playlist editing & YouTube export' enable button;
  per-channel 'Unsubscribe on YouTube' (with confirm) shown only when can_write

Browser-facing; develop/test locally until the public HTTPS login lands. Needs a
one-time Console step: add youtube.readonly to the OAuth consent screen scopes.

backend/app/routes/me.py

@@ -1,7 +1,7 @@
 from fastapi import APIRouter, Depends
 from sqlalchemy.orm import Session
 
-from app.auth import current_user
+from app.auth import current_user, has_write_scope
 from app.db import get_db
 from app.models import User
 
@@ -16,6 +16,7 @@ def get_me(user: User = Depends(current_user)) -> dict:
         "display_name": user.display_name,
         "avatar_url": user.avatar_url,
         "role": user.role,
+        "can_write": has_write_scope(user),
         "preferences": user.preferences or {},
     }