chore: YTM source — mount cookies volume; bump mcma-backend + mcma-webui

docker-compose.yml mounts ./data/youtube on api+worker for an optional yt-dlp cookies.txt; .env.example documents YOUTUBE_COOKIES_PATH. Bumps the backend + webui submodules to the YTM search/download feature commits. (mcma-bootstrap stays untracked — separate repo.)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.env.example

@@ -50,7 +50,14 @@ ACOUSTID_API_KEY=
 # Your contact email, sent to MusicBrainz/AcoustID as part of the User-Agent
 # (required by their usage policy — apps without one get throttled).
 MUSICBRAINZ_OWNER_EMAIL=
-# YOUTUBE_COOKIES_PATH=/data/cookies.txt
+# YouTube Music source (search + download via yt-dlp). Enabled by default;
+# set to false to hide it from /sources.
+# YOUTUBE_ENABLED=true
+# Optional yt-dlp cookies for age/region-restricted downloads. The host folder
+# ./data/youtube is mounted at /data/youtube in api+worker; drop your exported
+# cookies.txt there. Search and most downloads work without it — it's only used
+# when the file is present, so leaving this set with no file is harmless.
+YOUTUBE_COOKIES_PATH=/data/youtube/cookies.txt
 
 # ---- Frontend (webui) ------------------------------------------------
 # Served same-origin behind nginx, so the default '/api/v1' just works.

docker-compose.yml

@@ -58,6 +58,7 @@ services:
       - /app/.venv # keep the image's venv, don't shadow it
       - ./data/media:/data/media
       - ./data/transcode-cache:/data/transcode-cache
+      - ./data/youtube:/data/youtube # yt-dlp cookies.txt (optional; see .env)
     ports:
       - "${API_PORT:-8000}:8000" # direct access for debugging / docs
     depends_on:
@@ -79,6 +80,7 @@ services:
       - /app/.venv
       - ./data/media:/data/media
       - ./data/transcode-cache:/data/transcode-cache
+      - ./data/youtube:/data/youtube # yt-dlp cookies.txt (optional; see .env)
     depends_on:
       db: { condition: service_healthy }
       redis: { condition: service_healthy }