Fix cookie fallback breaking yt-dlp in Docker; add OAuth2 auth flow

- _cookie_args() no longer falls through to --cookies-from-browser when
  cookies_file is configured but missing. Firefox isn't installed in the
  Docker image, so that fallback caused yt-dlp to exit with empty stdout
  and every metadata fetch to return "Video not found on YouTube".
- fetch_video_metadata() now retries without auth args if the first call
  fails, so a broken cookie config can't block public video fetches.
- Add use_oauth2 setting + full device-auth flow (POST /settings/oauth2-init,
  GET /settings/oauth2-status) with OAuth2Section UI in Settings page.
- Add GET /settings/ytdlp-test diagnostics endpoint.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/models.py

@@ -118,6 +118,7 @@ class UserSettings(Base):
     feed_weight_recency = Column(Float, default=5.0)   # 0–10
     feed_weight_affinity = Column(Float, default=5.0)  # 0–10
     feed_weight_channel = Column(Float, default=5.0)   # 0–10
+    use_oauth2 = Column(Boolean, default=False)
 
 
 class DiscoveryQueue(Base):