feat(server): supply YouTube cookies to the API container via .env

Set YTDLP_COOKIES_HOST in server/.env and compose mounts the host
cookies.txt read-only at /cookies.txt and wires YTDLP_COOKIES
automatically — no compose edits per host. Falls back to /dev/null when
unset so the container still starts. Add server/.env.example, gitignore
server/.env, and document the flow.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

README.md

@@ -207,15 +207,17 @@ Use a Netscape-format cookie exporter, then point `--cookies` / `$YTDLP_COOKIES`
    ./musicfetch --repair --cookies ~/cookies.txt -o /media/music
    ```
 
-   For the API container, mount it and set the env var (see `server/docker-compose.yml`):
+   For the API container, just point it at the host file via `.env` — no compose
+   edits needed (see `server/.env.example`):
 
-   ```yaml
-   environment:
-     YTDLP_COOKIES: "/cookies.txt"
-   volumes:
-     - /host/path/cookies.txt:/cookies.txt:ro
+   ```bash
+   # server/.env
+   YTDLP_COOKIES_HOST=/host/path/cookies.txt
    ```
 
+   The compose mounts it read-only at `/cookies.txt` and sets `YTDLP_COOKIES`
+   automatically. Leave `YTDLP_COOKIES_HOST` unset to run without cookies.
+
 Cookies expire — if YouTube starts rejecting them, re-export. Treat `cookies.txt` like a
 password (it *is* your logged-in session); keep it out of git (`.gitignore` it).