feat: ship remote login backend

[Priveetee]

Summary

• add the TypeType-Server facade for YouTube remote browser login through TypeType-Token
• store YouTube Session credentials encrypted per user and keep cookies, poToken and internal tokens server-side
• return signed authenticated HLS manifest URLs from /streams and serve /streams/hls-manifest without requiring an Authorization header
• expose /instance.youtubeRemoteLoginEnabled behind both the admin setting and the configured internal token
• make PUT /progress replace the stored position, including lower values and 0
• update the OpenAPI contract for remote login, authenticated HLS, progress and settings behavior

Notes

• remote login stays hidden until youtubeRemoteLoginEnabled=true is enabled in admin settings after prod smoke tests
• Server and Token must share the same YOUTUBE_REMOTE_LOGIN_INTERNAL_TOKEN
• the TypeType nginx /api/ proxy must forward WebSocket upgrades for /youtube-session/browser/...
• migrations are startup-safe and cover the admin setting plus YouTube Session storage
• rollback is disabling youtubeRemoteLoginEnabled first, then rolling back Server/Token/Frontend images if needed

Runtime verification

• beta Server image validated: ghcr.io/priveetee/typetype-server-beta@sha256:ed1e30f30216916bd0ea714212480d0d7a7933a9cb4b5788c019699c1ec248d9
• beta /api/health returns 200
• beta /api/progress sequence verified: 6164317 -> 1234 -> 0
• beta /api/youtube-session/browser/... WebSocket handshake returns 101 Switching Protocols through the frontend proxy
• authenticated HLS beta flow verified with signed manifest URL, Cache-Control: no-store, variant playlist and segment proxy

Tests

• ./gradlew test
• ./gradlew shadowJar
• dev branch checks passed: OpenAPI, Coverage, CI, Docker