Fix YouTube downloads: bump yt-dlp, require Node 22, drop YT cookies

Two YouTube regressions stacked up:

- yt-dlp 2026.3.17 hit "HTTP Error 403: Forbidden" on the actual media
  download. Bumping to 2026.6.9 fixes the data-download 403, but its EJS
  n-sig challenge solver now requires Node >= 22, and Debian 13 only ships
  Node 20 ("node-20.x (unsupported)" -> only image formats resolve). bot.py
  now points --js-runtimes at a standalone /opt/node22 via the new
  JS_RUNTIME constant.

- With a cookies.txt present, yt-dlp skips the cookieless android_vr/android
  clients (whose URLs work) and falls back to the `tv` client, whose media
  URLs 403. New _cookie_args(url) withholds cookies for YouTube hosts only,
  while still sending them to Instagram/TikTok/X.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

README.md

@@ -50,7 +50,11 @@ Signal  ──►  signal-cli-rest-api (json-rpc, :8080)  ──►  bot.py (sig
    python3 -m venv venv
    venv/bin/pip install -r requirements.txt
    ```
-   YouTube also needs a system `node` on PATH (for `yt-dlp-ejs`).
+   YouTube also needs **Node >= 22** on PATH (for `yt-dlp-ejs`'s challenge
+   solver). If your distro only ships an older Node, install a standalone Node 22+
+   and point `bot.py`'s `_NODE22` at it. Note: YouTube cookies are deliberately
+   withheld (`_cookie_args`) — sending account cookies forces yt-dlp onto a player
+   client whose media URLs 403; cookieless YouTube requests work.
 
 3. **Cookies:** copy `cookies.txt.example` to `cookies.txt` and fill in real
    exported cookies for the sites you want auth'd. (gitignored)