feat: implement server password login, YouTube source, and improved bot selector UI

- **TS server password** (#7/#9): add serverPassword field across database,
  manager, bot API, and Settings UI — allows joining password-protected servers
- **YouTube audio source** (#1/#10): new YouTubeProvider using yt-dlp binary;
  adds -y flag in chat commands, /api/music supports platform=youtube,
  YouTube badge in SongCard, yt-dlp-wrap npm dependency
- **Bot selector UI** (#14): selector always visible (not just when >1 bot),
  bigger button with border and play-state indicator; per-bot URL routing at
  /bot/:id with BotRedirect view; copy-link button in dropdown

Closes #1, #7, #9, #10, #14

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

package-lock.json

@@ -25,7 +25,8 @@
         "pino": "^10.3.1",
         "ts3-nodejs-library": "^3.5.1",
         "tweetnacl": "^1.0.3",
-        "ws": "^8.20.0"
+        "ws": "^8.20.0",
+        "yt-dlp-wrap": "^2.3.12"
       },
       "devDependencies": {
         "@types/better-sqlite3": "^7.6.13",
@@ -6268,6 +6269,13 @@
       "engines": {
         "node": ">= 4.0.0"
       }
+    },
+    "node_modules/yt-dlp-wrap": {
+      "version": "2.3.12",
+      "resolved": "https://registry.npmjs.org/yt-dlp-wrap/-/yt-dlp-wrap-2.3.12.tgz",
+      "integrity": "sha512-P8fJ+6M1YjukyJENCTviNLiZ8mokxprR54ho3DsSKPWDcac489OjRiStGEARJr6un6ETS6goTn4CWl/b/rM3aA==",
+      "deprecated": "Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.",
+      "license": "MIT"
     }
   }
 }