feat: add YouTube session backend

[Priveetee]

Summary

• add encrypted per-user YouTube session storage and pairing flow
• expose YouTube Session REST endpoints for frontend/WebView handoff
• inject PipePipe YouTube tokens only inside authenticated extraction scope
• preserve public stream extraction and use auth sessions only for HLS fallback/enrichment

Runtime verification

• POST /youtube-session/pairing returns a short code and expiry
• POST /youtube-session/complete stores Netscape cookies + poToken without returning secrets
• GET /youtube-session/status returns connected after completion
• GET /streams public path keeps direct streams and codecs
• GET /streams with auth session enables HLS while preserving direct streams/codecs

Tests

• JAVA_HOME=/usr/lib/jvm/java-25-openjdk ./gradlew test
• JAVA_HOME=/usr/lib/jvm/java-25-openjdk ./gradlew check
• JAVA_HOME=/usr/lib/jvm/java-25-openjdk ./gradlew shadowJar