Add the YouTube submission path

Step 5. A URL goes through the same pipeline as an upload — it just gains a
download step and a source_url.

- The host allowlist is checked on the parsed hostname before yt-dlp is
  invoked, so lookalikes and userinfo tricks are refused too
- yt-dlp -J reads metadata synchronously with a 15s timeout; a timeout leaves
  the fields blank rather than failing the submission
- Over-long tracks are refused from that metadata, before a byte is downloaded
- Failed URL submissions offer Yritä uudelleen with the typed text intact;
  uploads cannot retry, so they offer re-upload

Prefill takes track then title, and artist then creator then uploader, and
leaves a field blank rather than inventing one. testdata/ytdlp-noose.json is a
real dump of an ordinary upload, which has none of the music fields.

Also fixes a URL-only submit being blocked by the file input's required
attribute — HTML cannot express "one of these two", so the server says it.

The image now takes yt-dlp from Alpine 3.24 instead of pip, which drops
python3 and pip entirely; see decision 19.

docs/spec.md

@@ -288,7 +288,9 @@ but its submitter, so a broken pipeline has no other way of announcing itself.
 
 ### 4.7 Operational notes
 
-- **yt-dlp rots.** `pip install -U yt-dlp` at image build; rebuild monthly.
+- **yt-dlp rots.** Installed with `apk add yt-dlp` from Alpine's active branch, which tracks
+  upstream closely; rebuild monthly. If the packaged version ever lags at a bad moment,
+  `pip install -U yt-dlp` is the fallback — at the cost of python3 and pip in the image.
 - Downloading YouTube audio is against YouTube's ToS. This is a private app among friends; the
   decision is deliberate rather than accidental.