Initial implementation of youtube-automate

A DVR for YouTube subscriptions, laid out so Jellyfin presents each channel
as a show and each video as an episode. Cron-driven, idempotent, with a
public admin UI for a non-operator.

Verified end to end on susan against three real channels: PO tokens, h264
downloads, Jellyfin resolution from local NFOs with all providers disabled,
retention and tombstones.

Corrections to the original design handover (specs.md documents each with
the evidence, and specs.handover-original.md preserves the original):

- The format sort selected 360p. Ranking acodec above res makes `bv*` prefer
  the combined 360p stream, which carries AAC, over the 720p video-only
  stream whose acodec is none. vcodec now leads, so a video without h264 at
  720p yields h264 lower down rather than VP9 this hardware cannot transcode.
- yt-dlp now requires a JS runtime and the yt-dlp-ejs solver scripts, which
  only ship with the [default] extra. Without them the n challenge fails and
  the mweb formats disappear entirely.
- --flat-playlist carries no upload dates, so the specced client-side date
  filter for backfill was impossible. Backfill is RSS-first.
- skipped_old was terminal, so raising a channel's retention appeared to do
  nothing. Added an explicit rescan.
- is_upcoming premieres now defer and retry instead of being skipped forever.
- TubeArchivist is gone, so the media root and the tube.jihakuz.xyz vhost
  were both reclaimed; the latter still pointed at its dead port.

240 offline tests, no network and no real yt-dlp invocation.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

deploy/fix-nginx-tube.sh

@@ -0,0 +1,66 @@
+#!/bin/bash
+# Repoint the existing tube.jihakuz.xyz vhost at youtube-automate.
+#
+# Why this exists: tube.jihakuz.xyz was already served by a leftover
+# TubeArchivist server block inside /etc/nginx/sites-available/jihakuz.xyz,
+# proxying to 127.0.0.1:8003. That block loads before the standalone vhost
+# deploy.sh installs (nginx takes the first server block matching a name), so
+# every request went to the dead TubeArchivist port and returned 502.
+#
+# That old block already owns the Let's Encrypt certificate for the hostname,
+# so the right fix is to repoint it rather than duplicate it — no second
+# certbot run needed.
+#
+#     sudo /opt/youtube-automate/deploy/fix-nginx-tube.sh
+set -euo pipefail
+
+CONF=/etc/nginx/sites-available/jihakuz.xyz
+STANDALONE=/etc/nginx/sites-enabled/tube.jihakuz.xyz
+OLD_PORT=8003
+NEW_PORT=8085
+
+if [[ $EUID -ne 0 ]]; then
+    echo "This script needs root. Run: sudo $0" >&2
+    exit 1
+fi
+
+if ! grep -q "127.0.0.1:${OLD_PORT}" "$CONF"; then
+    if grep -q "127.0.0.1:${NEW_PORT}" "$CONF"; then
+        echo "Already repointed at ${NEW_PORT}; nothing to do."
+        exit 0
+    fi
+    echo "Did not find 127.0.0.1:${OLD_PORT} in $CONF — nothing to change." >&2
+    exit 1
+fi
+
+BACKUP="${CONF}.bak-$(date +%Y%m%d%H%M%S)"
+cp -a "$CONF" "$BACKUP"
+echo "==> Backed up $CONF to $BACKUP"
+
+# X-Forwarded-For is not cosmetic: the app throttles failed logins per client
+# address and reads it from that header. Without it every attempt looks like it
+# came from nginx itself, so one attacker would lock out everybody.
+sed -i \
+  "s|proxy_pass http://127.0.0.1:${OLD_PORT};|proxy_pass http://127.0.0.1:${NEW_PORT};\n\t\tproxy_http_version 1.1;\n\t\tproxy_set_header Host \$host;\n\t\tproxy_set_header X-Real-IP \$remote_addr;\n\t\tproxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;\n\t\tproxy_set_header X-Forwarded-Proto \$scheme;|" \
+  "$CONF"
+echo "==> Repointed tube.jihakuz.xyz at 127.0.0.1:${NEW_PORT}"
+
+# The standalone vhost is now redundant and would only produce a
+# "conflicting server name" warning.
+if [[ -L "$STANDALONE" || -f "$STANDALONE" ]]; then
+    rm -f "$STANDALONE"
+    echo "==> Removed the redundant standalone vhost $STANDALONE"
+fi
+
+if ! nginx -t; then
+    echo "!! nginx config test failed — restoring the backup" >&2
+    cp -a "$BACKUP" "$CONF"
+    nginx -t
+    exit 1
+fi
+
+systemctl reload nginx
+echo "==> nginx reloaded"
+echo
+echo "Verify with:"
+echo "    curl -sI https://tube.jihakuz.xyz/ | head -1     # expect 303 -> /login"