feat: migrate to denoland/deno base image and integrate bgutil-ytdlp-pot-provider for YouTube POToken support (#7)

Integrate bgutil-ytdlp-pot-provider to enable YouTube POToken
authentication, avoiding bot detection. This requires deno runtime,
necessitating a base image change.

## Changes

- **Base image**: `alpine:3` → `docker.io/denoland/deno:alpine` for deno
runtime support
- **yt-dlp version**: `2025.08.22` → `2025.12.08`
- **POToken integration**:
  - Copy bgutil-pot server binary to `/usr/bin/`
- Copy bgutil-ytdlp-pot-provider plugin to
`/etc/yt-dlp-plugins/bgutil-ytdlp-pot-provider`
  - Create plugin directory with proper permissions

## Verification

Running `yt-dlp -v` in the built image confirms:
- deno runtime available and used by yt-dlp
- bgutil-pot found in PATH
- POToken providers registered (bgutil:cli, bgutil:http)
- Plugin directory correctly detected

```
[debug] JS runtimes: deno-2.6.0
[debug] [youtube] [pot:bgutil:cli] Found bgutil-pot in PATH
[debug] [youtube] [pot] PO Token Providers: bgutil:cli-1.2.2 (external), bgutil:http-1.2.2 (external)
```

<!-- START COPILOT CODING AGENT SUFFIX -->



<!-- START COPILOT ORIGINAL PROMPT -->



<details>

<summary>Original prompt</summary>

> Our `Dockerfile` currently uses `alpine:3` as the base image in the
final stage. Your task is to change the final stage's base image to
`docker.io/denoland/deno:alpine` and integrate both the client and
server of `jim60105/bgutil-ytdlp-pot-provider-rs` into this Dockerfile.
And also, change yt-dlp ARG to version 2025.12.08
> 
> To add bgutil-ytdlp-pot-provider-rs, use:
> 
> ```Dockerfile
> # Copy POToken server (bgutil-pot)
> COPY --link --chown=$APP_UID:0 --chmod=775
--from=ghcr.io/jim60105/bgutil-pot:latest /bgutil-pot /usr/bin/
> 
> # Copy POToken client plugin
> COPY --link --chown=$APP_UID:0 --chmod=775
--from=ghcr.io/jim60105/bgutil-pot:latest /client
/etc/yt-dlp-plugins/bgutil-ytdlp-pot-provider
> ```
> 
> How to verify:
> 
> Run the built image temporarily with entrypoint="/usr/bin/yt-dlp" and
cmd="-v IgYHzexgMJg". The output must indicate that it is using the
bgutil POT provider bin and deno as the JS backend. If you see "deno not
found" or it does not mention using bgutil POT provider bin, then this
setup has failed and must be fixed. Note that these temporary changes to
entrypoint and cmd are only for testing; do not include them in your
Dockerfile.
> 
> You cannot run LivestreamRecorderService because your development
environment is not properly configured. Do not spend time trying to run
LivestreamRecorderService program.


</details>



<!-- START COPILOT CODING AGENT TIPS -->
---

✨ Let Copilot coding agent [set things up for
you](https://github.com/Recorder-moe/LivestreamRecorderService/issues/new?title=✨+Set+up+Copilot+instructions&body=Configure%20instructions%20for%20this%20repository%20as%20documented%20in%20%5BBest%20practices%20for%20Copilot%20coding%20agent%20in%20your%20repository%5D%28https://gh.io/copilot-coding-agent-tips%29%2E%0A%0A%3COnboard%20this%20repo%3E&assignees=copilot)
— coding agent works faster and does higher quality work when set up for
your repo.

Author: jim60105

Dockerfile

@@ -3,7 +3,7 @@ ARG UID=1654
 ARG VERSION=EDGE
 ARG RELEASE=0
 ARG BUILD_CONFIGURATION=ApacheCouchDB_Release
-ARG YTDLP_VERSION=2025.08.22
+ARG YTDLP_VERSION=2025.12.08
 
 ########################################
 # Debug stage
@@ -53,7 +53,7 @@ RUN --mount=source=.,target=.,rw \
 ########################################
 # Final stage
 ########################################
-FROM alpine:3 AS final
+FROM docker.io/denoland/deno:alpine AS final
 
 # RUN mount cache for multi-arch: https://github.com/docker/buildx/issues/549#issuecomment-1788297892
 ARG TARGETARCH
@@ -72,7 +72,8 @@ RUN --mount=type=cache,id=apk-$TARGETARCH$TARGETVARIANT,sharing=locked,target=/v
 # Create directories with correct permissions
 RUN install -d -m 775 -o $UID -g 0 /app && \
     install -d -m 775 -o $UID -g 0 /licenses && \
-    install -d -m 775 -o $UID -g 0 /.cache
+    install -d -m 775 -o $UID -g 0 /.cache && \
+    install -d -m 775 -o $UID -g 0 /etc/yt-dlp-plugins
 
 # Copy licenses (OpenShift Policy)
 COPY --link --chown=$UID:0 --chmod=775 LICENSE /licenses/LICENSE
@@ -85,6 +86,12 @@ COPY --link --from=ghcr.io/jim60105/static-ffmpeg-upx:8.0 /ffprobe /usr/bin/
 # dumb-init
 COPY --link --from=ghcr.io/jim60105/static-ffmpeg-upx:8.0 /dumb-init /usr/bin/
 
+# Copy POToken server (bgutil-pot)
+COPY --link --chown=$APP_UID:0 --chmod=775 --from=ghcr.io/jim60105/bgutil-pot:latest /bgutil-pot /usr/bin/
+
+# Copy POToken client plugin
+COPY --link --chown=$APP_UID:0 --chmod=775 --from=ghcr.io/jim60105/bgutil-pot:latest /client /etc/yt-dlp-plugins/bgutil-ytdlp-pot-provider
+
 # yt-dlp
 ARG YTDLP_VERSION
 ADD --link --chown=$UID:0 --chmod=775 https://github.com/yt-dlp/yt-dlp/releases/download/${YTDLP_VERSION}/yt-dlp_linux /usr/bin/yt-dlp