Add YouTube cookie settings and shared session storage

[meoyawn]

When YouTube requests sign-in, users can now open Settings → YouTube or run listenbox youtube-cookies import <cookies.txt> to save the same Netscape export. The CLI and desktop share a private cookie jar with concurrent snapshot reads, atomic writes, and generation/per-cookie revision checks that protect cookie rotations and user replacements.

• Send credentials only to YouTube metadata requests; keep them off media hosts and Listenbox requests. Remove cookies from Settings or the CLI to return to anonymous access.
• Skip unavailable videos and media refusals for the current sync, then reconsider them on the next pass.
• Build the pinned YouTube.js source with client-owned Moon tasks and offline regressions in vendor/. Aube installs from upstream’s unchanged package-lock.json; the submodule pins fork main at 600a8cb83ecb5ebd55f7b4723c17e03d3ad19498, which contains the merged two-line source fix.

Validation: local moon ci in the standalone client and parent workspace; deterministic cookie rotation, cross-process atomic updates, settings recovery, and mixed playable/unavailable coverage. A clean source build preserves the upstream lockfile, and the relocated build produces the identical embedded bundle. A separate manual live probe with an isolated cookie profile found three accessible videos and five skips; no credentials or authenticated captures were added to the repository. Native Windows execution was not exercised locally.

Source fixes: fork PR, upstream PR. The fork PR is merged, and the client now pins its commit on fork main. Its source tree is identical to the previously tested feature-branch commit. Local standalone client and parent moon ci were checked again for this pin update.