v0.22.1: not a bot

Import from URL now gets past YouTube's "Sign in to confirm you're not a
bot": a run that downloads nothing for that reason retries once with
yt-dlp's --cookies-from-browser (Firefox first), and a browser that worked
is remembered in this machine's config.json so later imports send the
cookies from the start.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

CLAUDE.md

@@ -279,7 +279,13 @@ persistence) → GUI (Qt widgets that read the manager and connect to its signal
   order (`position + songs already inserted`). With no AcoustID key,
   `TrackIdentifier` proposes from the filename alone and never touches fpcalc
   or the network. Only a URL import reaches that path, since the menu route
-  still insists on setup first.
+  still insists on setup first. YouTube's "Sign in to confirm you're not a
+  bot" is about the *network* (`song` hits it too), and yt-dlp's cure is the
+  browser's cookies: a run that downloads **nothing** for that reason is
+  retried once with `--cookies-from-browser` (`default_cookies_browser`,
+  Firefox first), and a browser that worked is saved as
+  `ytdlp_cookies_browser` in **`config.json`**, not preferences — which
+  browser holds a YouTube login is this machine's business (Round 59).
 
 - **`lintunes/mpris.py`** — registers `org.mpris.MediaPlayer2.lintunes` over D-Bus
   so the desktop's media keys / now-playing popup control playback. Spacebar and