chore: YTM source — mount cookies volume; bump mcma-backend + mcma-webui

docker-compose.yml mounts ./data/youtube on api+worker for an optional yt-dlp cookies.txt; .env.example documents YOUTUBE_COOKIES_PATH. Bumps the backend + webui submodules to the YTM search/download feature commits. (mcma-bootstrap stays untracked — separate repo.)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.env.example

@@ -50,7 +50,14 @@ ACOUSTID_API_KEY=
 # Your contact email, sent to MusicBrainz/AcoustID as part of the User-Agent
 # (required by their usage policy — apps without one get throttled).
 MUSICBRAINZ_OWNER_EMAIL=
-# YOUTUBE_COOKIES_PATH=/data/cookies.txt
+# YouTube Music source (search + download via yt-dlp). Enabled by default;
+# set to false to hide it from /sources.
+# YOUTUBE_ENABLED=true
+# Optional yt-dlp cookies for age/region-restricted downloads. The host folder
+# ./data/youtube is mounted at /data/youtube in api+worker; drop your exported
+# cookies.txt there. Search and most downloads work without it — it's only used
+# when the file is present, so leaving this set with no file is harmless.
+YOUTUBE_COOKIES_PATH=/data/youtube/cookies.txt
 
 # ---- Frontend (webui) ------------------------------------------------
 # Served same-origin behind nginx, so the default '/api/v1' just works.