Support optional YouTube OAuth and poToken fallbacks - #4

Summary

• Configure cipher, OAuth, and poToken independently; none excludes another.
• Add optional YOUTUBE_OAUTH_REFRESH_TOKEN, YOUTUBE_PO_TOKEN, and YOUTUBE_VISITOR_DATA settings to Compose and .env.example.
• Treat blank values as unset; reject incomplete poToken/visitor-data pairs before opening the Discord connection.
• Use Music, Android VR, Web, and Web Embedded, with TV appended only when OAuth is configured. Apply poToken to both Web clients. OAuth enables a separate TV fallback, not combined credentials on Web requests.
• Delegate OAuth access-token renewal to youtube-source, with interactive login disabled. Fail clearly if configured OAuth cannot initialize.
• Keep diagnostics small: secret-free mode/client startup summary and guild-scoped playback failure/stall warnings. Guard failure notifications so notification exceptions do not prevent queue advancement.

Deliberate scope limits

No testing framework/dependencies, monitoring stack, counters, health probes, alerts, automatic poToken generation/renewal, or general audio-callback refactor. Better monitoring and automated testing remain separate follow-ups.

Validation

• ./gradlew --no-daemon clean shadowJar passes with JDK 25.
• Local temporary smoke harness (not committed) verified default client order, blank settings, remote cipher + poToken configuration on both Web clients, and rejection of either incomplete token pair. Supplied fake credentials were absent from captured output.
• Workflow lint and Git whitespace checks pass.
• Live OAuth authorization/refresh, YouTube playback/client fallback, Discord notifications, and Docker execution have not been exercised locally. These need deployment validation with credentials supplied on the host.