fix: support file-backed remote login token

[Priveetee]

Summary

• allow Token to read YOUTUBE_REMOTE_LOGIN_INTERNAL_TOKEN_FILE
• ignore known placeholder token values so generated file-backed secrets can take over
• keep YOUTUBE_REMOTE_LOGIN_INTERNAL_TOKEN as the first-priority source for existing installs

Production behavior

• existing real environment tokens keep working
• compose-only stacks can share the generated internal token file with Server
• this Token change must ship with the matching Server and TypeType compose changes

Verification

• bun run lint
• bun test
• bun run build
• git diff --check
• dev branch checks passed: Coverage, CI, Docker

Rollback

• rollback the Token image if file-backed token loading regresses
• direct environment tokens remain supported during rollback