Add the YouTube submission path

Step 5. A URL goes through the same pipeline as an upload — it just gains a
download step and a source_url.

- The host allowlist is checked on the parsed hostname before yt-dlp is
  invoked, so lookalikes and userinfo tricks are refused too
- yt-dlp -J reads metadata synchronously with a 15s timeout; a timeout leaves
  the fields blank rather than failing the submission
- Over-long tracks are refused from that metadata, before a byte is downloaded
- Failed URL submissions offer Yritä uudelleen with the typed text intact;
  uploads cannot retry, so they offer re-upload

Prefill takes track then title, and artist then creator then uploader, and
leaves a field blank rather than inventing one. testdata/ytdlp-noose.json is a
real dump of an ordinary upload, which has none of the music fields.

Also fixes a URL-only submit being blocked by the file input's required
attribute — HTML cannot express "one of these two", so the server says it.

The image now takes yt-dlp from Alpine 3.24 instead of pip, which drops
python3 and pip entirely; see decision 19.

docs/decisions.md

@@ -66,8 +66,12 @@ and `storage` was test data, so **the schema has no legacy to respect.**
 18. **The issue reporter ships in v1.** One table and two handlers, and the month it is most needed
     is the first one. Members never touch the Gitea tracker; the admin transcribes anything worth
     tracking.
-19. **yt-dlp: `pip install -U yt-dlp` at image build, rebuild monthly.** Pinning only schedules the
-    breakage for a moment you did not choose.
+19. **yt-dlp is updated by rebuilding the image, monthly.** Pinning a version only schedules the
+    breakage for a moment you did not choose. Originally `pip install -U yt-dlp`; changed on
+    2026-07-31 to `apk add yt-dlp` once Alpine 3.24 turned out to carry the current release
+    (2026.07.04, four weeks old) — which drops python3 and pip from the image entirely. The apk
+    route inherits Alpine's packaging lag, so pip is the fallback if it ever goes stale at a bad
+    moment. Note that this only holds on the *active* branch: 3.21 was 16 months behind.
 20. **Parity plus YouTube, then iterate.** Nothing from the old `docs/IDEAS.md` and nothing from the
     unbuilt-stats list ships in v1.
 

docs/spec.md

@@ -288,7 +288,9 @@ but its submitter, so a broken pipeline has no other way of announcing itself.
 
 ### 4.7 Operational notes
 
-- **yt-dlp rots.** `pip install -U yt-dlp` at image build; rebuild monthly.
+- **yt-dlp rots.** Installed with `apk add yt-dlp` from Alpine's active branch, which tracks
+  upstream closely; rebuild monthly. If the packaged version ever lags at a bad moment,
+  `pip install -U yt-dlp` is the fallback — at the cost of python3 and pip in the image.
 - Downloading YouTube audio is against YouTube's ToS. This is a private app among friends; the
   decision is deliberate rather than accidental.