Fix cookie fallback breaking yt-dlp in Docker; add OAuth2 auth flow

- _cookie_args() no longer falls through to --cookies-from-browser when
  cookies_file is configured but missing. Firefox isn't installed in the
  Docker image, so that fallback caused yt-dlp to exit with empty stdout
  and every metadata fetch to return "Video not found on YouTube".
- fetch_video_metadata() now retries without auth args if the first call
  fails, so a broken cookie config can't block public video fetches.
- Add use_oauth2 setting + full device-auth flow (POST /settings/oauth2-init,
  GET /settings/oauth2-status) with OAuth2Section UI in Settings page.
- Add GET /settings/ytdlp-test diagnostics endpoint.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/main.py

@@ -70,6 +70,7 @@ def on_startup():
         "ALTER TABLE user_settings ADD COLUMN feed_weight_recency REAL DEFAULT 5.0",
         "ALTER TABLE user_settings ADD COLUMN feed_weight_affinity REAL DEFAULT 5.0",
         "ALTER TABLE user_settings ADD COLUMN feed_weight_channel REAL DEFAULT 5.0",
+        "ALTER TABLE user_settings ADD COLUMN use_oauth2 INTEGER DEFAULT 0",
         """CREATE TABLE IF NOT EXISTS search_history (
             id INTEGER PRIMARY KEY AUTOINCREMENT,
             user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
@@ -144,6 +145,7 @@ def on_startup():
             ytdlp_service.set_max_concurrent(first_user_settings.max_concurrent_downloads)
             ytdlp_service.set_cookies_browser(first_user_settings.cookies_browser or "")
             ytdlp_service.set_cookies_file(first_user_settings.cookies_file or "")
+            ytdlp_service.set_oauth2(bool(getattr(first_user_settings, "use_oauth2", False)))
     finally:
         db.close()