feat(m5b): optional YouTube write scope via incremental OAuth

Default login now requests read-only (youtube.readonly); write (unsubscribe,
later playlist export) is an explicit opt-in.

- auth.py: split READ_SCOPES / WRITE_SCOPES; new GET /auth/upgrade (incremental
  consent, prompt=consent); has_write_scope() helper
- /api/me exposes can_write
- youtube/client.py: delete_subscription (50 units, OAuth-only)
- DELETE /api/channels/{id}/subscription, gated on write scope (403 otherwise)
- UI: Settings - Account 'Playlist editing & YouTube export' enable button;
  per-channel 'Unsubscribe on YouTube' (with confirm) shown only when can_write

Browser-facing; develop/test locally until the public HTTPS login lands. Needs a
one-time Console step: add youtube.readonly to the OAuth consent screen scopes.

frontend/src/lib/api.ts

@@ -6,6 +6,7 @@ export interface Me {
   display_name: string | null;
   avatar_url: string | null;
   role: string;
+  can_write: boolean;
   preferences: Record<string, any>;
 }
 
@@ -198,6 +199,8 @@ export const api = {
     req(`/api/channels/${id}/tags`, { method: "POST", body: JSON.stringify({ tag_id: tagId }) }),
   detachChannelTag: (id: string, tagId: number) =>
     req(`/api/channels/${id}/tags/${tagId}`, { method: "DELETE" }),
+  unsubscribeChannel: (id: string) =>
+    req(`/api/channels/${id}/subscription`, { method: "DELETE" }),
   syncSubscriptions: () => req("/api/sync/subscriptions", { method: "POST" }),
 
   // --- user tags ---