feat: finalize remote login readiness

[Priveetee]

Summary

• expose non-secret YouTube remote login readiness on /instance
• keep youtubeRemoteLoginEnabled true only when the admin setting, Server config, YouTube Session crypto and Token health are ready
• return a frontend-usable unavailable reason: disabled, not_configured, token_unreachable or null
• document the /instance metadata response in OpenAPI
• keep YouTube Session crypto optional so anonymous extraction remains available without session config
• update the Docker QEMU setup action to the Node 24 release and disable QEMU image cache warnings

Notes

• remote login stays gated by the admin setting and runtime readiness
• Token API calls stay unchanged and keep using the shared internal token
• Server/Token containers must be recreated if stack secrets are generated after containers are already running
• rollback is disabling youtubeRemoteLoginEnabled first, then rolling back Server/Frontend images if needed

Verification

• JAVA_HOME=/usr/lib/jvm/java-21-openjdk ./gradlew check shadowJar
• git diff --check
• dev branch checks passed: OpenAPI, Coverage, CI, Docker