Add the YouTube submission path

Step 5. A URL goes through the same pipeline as an upload — it just gains a
download step and a source_url.

- The host allowlist is checked on the parsed hostname before yt-dlp is
  invoked, so lookalikes and userinfo tricks are refused too
- yt-dlp -J reads metadata synchronously with a 15s timeout; a timeout leaves
  the fields blank rather than failing the submission
- Over-long tracks are refused from that metadata, before a byte is downloaded
- Failed URL submissions offer Yritä uudelleen with the typed text intact;
  uploads cannot retry, so they offer re-upload

Prefill takes track then title, and artist then creator then uploader, and
leaves a field blank rather than inventing one. testdata/ytdlp-noose.json is a
real dump of an ordinary upload, which has none of the music fields.

Also fixes a URL-only submit being blocked by the file input's required
attribute — HTML cannot express "one of these two", so the server says it.

The image now takes yt-dlp from Alpine 3.24 instead of pip, which drops
python3 and pip entirely; see decision 19.

Dockerfile

@@ -1,14 +1,14 @@
-FROM golang:1.24-alpine AS build
+FROM golang:1.26-alpine AS build
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download
 COPY . .
 RUN CGO_ENABLED=0 go build -o /levyraati .
 
-FROM alpine:3.21
-# yt-dlp rots against YouTube, so it is installed unpinned at build time and updated by rebuilding.
-RUN apk add --no-cache ffmpeg python3 py3-pip ca-certificates \
-    && pip install --break-system-packages --no-cache-dir -U yt-dlp
+FROM alpine:3.24
+# yt-dlp rots against YouTube. Alpine's active branch tracks it closely (3.24 carries the current
+# release), so a rebuild is the update — and this avoids python3 + pip in the image entirely.
+RUN apk add --no-cache ffmpeg yt-dlp ca-certificates
 COPY --from=build /levyraati /usr/local/bin/levyraati
 ENV STORAGE_DIR=/storage
 EXPOSE 8080