fix: yt-dlp'ye YouTube cookie desteği ekle (bot-check bypass)

android player_client YouTube'un "Sign in to confirm you're not a bot"
duvarını aşmadı — Coolify sunucusunun IP'si datacenter olarak
işaretlenmiş. Kimlik doğrulanmış bir tarayıcı oturumunun cookies.txt'i
YTDLP_COOKIES_B64 env değişkeni (Coolify'da ayarlandı, repo'da yok)
üzerinden container'a taşınıp /tmp'e yazılıyor ve her yt-dlp
çağrısına --cookies olarak veriliyor.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/api-daemon/src/ytdlpCookies.ts

@@ -0,0 +1,22 @@
+import { writeFileSync } from "node:fs";
+import { env } from "./env";
+
+const COOKIES_PATH = "/tmp/yt-cookies.txt";
+
+/**
+ * YouTube increasingly bot-checks yt-dlp requests from datacenter IPs
+ * ("Sign in to confirm you're not a bot"), which no --extractor-args
+ * combination reliably bypasses. An authenticated session's cookies avoid
+ * the check. The cookies file is never committed — it's decoded once at
+ * startup from a Coolify-managed env var into a local temp file.
+ */
+const cookiesFilePath: string | null = env.ytdlpCookiesB64
+  ? (() => {
+      writeFileSync(COOKIES_PATH, Buffer.from(env.ytdlpCookiesB64, "base64"), { mode: 0o600 });
+      return COOKIES_PATH;
+    })()
+  : null;
+
+export function ytdlpCookieArgs(): string[] {
+  return cookiesFilePath ? ["--cookies", cookiesFilePath] : [];
+}