Add the YouTube submission path

Step 5. A URL goes through the same pipeline as an upload — it just gains a
download step and a source_url.

- The host allowlist is checked on the parsed hostname before yt-dlp is
  invoked, so lookalikes and userinfo tricks are refused too
- yt-dlp -J reads metadata synchronously with a 15s timeout; a timeout leaves
  the fields blank rather than failing the submission
- Over-long tracks are refused from that metadata, before a byte is downloaded
- Failed URL submissions offer Yritä uudelleen with the typed text intact;
  uploads cannot retry, so they offer re-upload

Prefill takes track then title, and artist then creator then uploader, and
leaves a field blank rather than inventing one. testdata/ytdlp-noose.json is a
real dump of an ordinary upload, which has none of the music fields.

Also fixes a URL-only submit being blocked by the file input's required
attribute — HTML cannot express "one of these two", so the server says it.

The image now takes yt-dlp from Alpine 3.24 instead of pip, which drops
python3 and pip entirely; see decision 19.

static/style.css

@@ -228,3 +228,6 @@ button.danger:hover { background: #e53935; }
           padding: 0.8rem 1rem; margin-bottom: 1.2rem; }
 .status p { margin: 0 0 0.5rem; }
 button:disabled { background: var(--surface-2); color: var(--muted); cursor: not-allowed; }
+
+.or { text-align: center; color: var(--muted); text-transform: uppercase;
+      font-family: var(--font-head); margin: 0; }