Initial implementation of youtube-automate

A DVR for YouTube subscriptions, laid out so Jellyfin presents each channel
as a show and each video as an episode. Cron-driven, idempotent, with a
public admin UI for a non-operator.

Verified end to end on susan against three real channels: PO tokens, h264
downloads, Jellyfin resolution from local NFOs with all providers disabled,
retention and tombstones.

Corrections to the original design handover (specs.md documents each with
the evidence, and specs.handover-original.md preserves the original):

- The format sort selected 360p. Ranking acodec above res makes `bv*` prefer
  the combined 360p stream, which carries AAC, over the 720p video-only
  stream whose acodec is none. vcodec now leads, so a video without h264 at
  720p yields h264 lower down rather than VP9 this hardware cannot transcode.
- yt-dlp now requires a JS runtime and the yt-dlp-ejs solver scripts, which
  only ship with the [default] extra. Without them the n challenge fails and
  the mweb formats disappear entirely.
- --flat-playlist carries no upload dates, so the specced client-side date
  filter for backfill was impossible. Backfill is RSS-first.
- skipped_old was terminal, so raising a channel's retention appeared to do
  nothing. Added an explicit rescan.
- is_upcoming premieres now defer and retry instead of being skipped forever.
- TubeArchivist is gone, so the media root and the tube.jihakuz.xyz vhost
  were both reclaimed; the latter still pointed at its dead port.

240 offline tests, no network and no real yt-dlp invocation.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

deploy/nginx-tube.jihakuz.xyz.conf

@@ -0,0 +1,49 @@
+# youtube-automate admin UI — tube.jihakuz.xyz
+#
+# NOTE: on susan this file is NOT the vhost in use. tube.jihakuz.xyz was already
+# served by a leftover TubeArchivist server block inside
+# sites-available/jihakuz.xyz (proxying to the now-dead 127.0.0.1:8003), and
+# nginx uses the first server block matching a name. That block also already
+# owns the Let's Encrypt certificate, so the fix was to repoint it — see
+# deploy/fix-nginx-tube.sh. This file is kept as the reference config for a
+# clean install on a host without that history.
+#
+# Install this as /etc/nginx/sites-available/tube.jihakuz.xyz and symlink it into
+# sites-enabled, then run:
+#
+#     sudo certbot --nginx -d tube.jihakuz.xyz
+#
+# certbot rewrites this file to add the TLS server block and the 80->443
+# redirect, matching how the other vhosts on susan are set up.
+#
+# The DNS record and njal.la update key for tube.jihakuz.xyz already exist in
+# ~/.local/bin/update-dns.sh, so no DNS work is needed.
+
+server {
+    listen 80;
+    listen [::]:80;
+    server_name tube.jihakuz.xyz;
+
+    # Small admin forms only; nothing here accepts uploads.
+    client_max_body_size 256k;
+
+    # Belt and braces — the app sets these too, but a misconfigured upstream
+    # should not be able to drop them.
+    add_header X-Content-Type-Options nosniff always;
+    add_header X-Frame-Options DENY always;
+    add_header Referrer-Policy same-origin always;
+
+    location / {
+        proxy_pass http://127.0.0.1:8085;
+        proxy_http_version 1.1;
+
+        proxy_set_header Host              $host;
+        proxy_set_header X-Real-IP         $remote_addr;
+        # The app throttles failed logins per client address and reads it from
+        # this header, so it must be set correctly.
+        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        proxy_read_timeout 120s;
+    }
+}