Add the YouTube submission path

Step 5. A URL goes through the same pipeline as an upload — it just gains a
download step and a source_url.

- The host allowlist is checked on the parsed hostname before yt-dlp is
  invoked, so lookalikes and userinfo tricks are refused too
- yt-dlp -J reads metadata synchronously with a 15s timeout; a timeout leaves
  the fields blank rather than failing the submission
- Over-long tracks are refused from that metadata, before a byte is downloaded
- Failed URL submissions offer Yritä uudelleen with the typed text intact;
  uploads cannot retry, so they offer re-upload

Prefill takes track then title, and artist then creator then uploader, and
leaves a field blank rather than inventing one. testdata/ytdlp-noose.json is a
real dump of an ordinary upload, which has none of the music fields.

Also fixes a URL-only submit being blocked by the file input's required
attribute — HTML cannot express "one of these two", so the server says it.

The image now takes yt-dlp from Alpine 3.24 instead of pip, which drops
python3 and pip entirely; see decision 19.

README.md

@@ -100,8 +100,8 @@ endpoint and no recovery key — the credentials are the environment.
 
 ### yt-dlp goes stale
 
-yt-dlp needs regular updates to keep working against YouTube. It is installed with
-`pip install -U yt-dlp` at image build time, so rebuilding is how you update it:
+yt-dlp needs regular updates to keep working against YouTube. It comes from Alpine's community
+repository, whose active branch tracks upstream closely, so rebuilding is how you update it:
 
 ```sh
 docker compose build --no-cache app && docker compose up -d app