Add the YouTube submission path

Step 5. A URL goes through the same pipeline as an upload — it just gains a
download step and a source_url.

- The host allowlist is checked on the parsed hostname before yt-dlp is
  invoked, so lookalikes and userinfo tricks are refused too
- yt-dlp -J reads metadata synchronously with a 15s timeout; a timeout leaves
  the fields blank rather than failing the submission
- Over-long tracks are refused from that metadata, before a byte is downloaded
- Failed URL submissions offer Yritä uudelleen with the typed text intact;
  uploads cannot retry, so they offer re-upload

Prefill takes track then title, and artist then creator then uploader, and
leaves a field blank rather than inventing one. testdata/ytdlp-noose.json is a
real dump of an ordinary upload, which has none of the music fields.

Also fixes a URL-only submit being blocked by the file input's required
attribute — HTML cannot express "one of these two", so the server says it.

The image now takes yt-dlp from Alpine 3.24 instead of pip, which drops
python3 and pip entirely; see decision 19.

templates/submit.html

@@ -5,11 +5,15 @@
 
 <form method="post" action="/submit" enctype="multipart/form-data" class="stack">
   <label class="dropzone" id="dropzone" for="audio">
-    <input type="file" id="audio" name="audio" accept="audio/*" required>
+    <input type="file" id="audio" name="audio" accept="audio/*">
     <span class="dz-title">Raahaa äänitiedosto tähän</span>
     <span class="muted small">tai valitse napsauttamalla</span>
     <span class="filename" id="filename"></span>
   </label>
+  <p class="or">tai</p>
+  <label>YouTube-linkki
+    <input type="url" name="url" placeholder="https://www.youtube.com/watch?v=…">
+  </label>
   <button type="submit">Lähetä</button>
 </form>