test: cover remote login token contract

[Priveetee]

Summary

• cover the remote login route behavior when the internal token is missing
• cover callback completion refusal when the internal token is missing
• lock the current env-only runtime contract for YOUTUBE_REMOTE_LOGIN_INTERNAL_TOKEN

Production behavior

• no runtime code change
• TypeType-Token continues to read only YOUTUBE_REMOTE_LOGIN_INTERNAL_TOKEN at startup
• /health remains independent from the remote login secret
• /youtube-remote-login/start returns 503 when the internal token is not configured
• callback completion is not sent when the internal token is missing

Deployment requirements

• deploy only the TypeType-Token image built from this merge
• no Server, frontend, Downloader, or stack-wide redeploy is required for this PR
• the TypeType stack must still inject the same YOUTUBE_REMOTE_LOGIN_INTERNAL_TOKEN into Server and Token before container recreation

Runtime verification

• local handler smoke without internal token: /health 200 and /youtube-remote-login/start 503
• dev branch checks are green:
  • CI
  • Coverage
  • Docker

Tests

• bun run lint
• bun test
• bun run build
• git diff --check

Rollback

• rollback TypeType-Token to the previous production digest if the Token-only smoke fails
• no data migration or Server/frontend rollback is involved