feat(discovery): acquire recommendations that keep their names

Acquisition ran yt-dlp without --embed-metadata, so every download
arrived untagged. The scanner then stored the video id as the title and
"Unknown Artist" as the artist, the vetted-candidate tag check rejected
the mismatch, and all 18 acquired tracks were hidden and retired.

- Pass --embed-metadata so downloads carry real tags.
- Let a scan take fallback title/artist from the candidate, for sources
  that still ship untagged files.
- Install Deno alongside yt-dlp: YouTube guards some formats with a JS
  challenge yt-dlp must execute, and no other runtime is enabled.
- Dedupe candidates by artist and title. The (source, external_id) key
  misses the same song reaching us under two Deezer release ids.

Also carries the in-flight discovery work this builds on: the
Recommendations page replacing Discover, the discovery source service,
and the acquisition spec tests.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docker-compose.yml

@@ -59,9 +59,10 @@ services:
   worker:
     build:
       context: ./workers
-      # Keep the downloader absent unless an operator intentionally opts in.
+      # Enabled deliberately: the auto-seed discovery loop cannot acquire a
+      # candidate without the downloader present.
       args:
-        INSTALL_YTDLP: "false"
+        INSTALL_YTDLP: "true"
     restart: unless-stopped
     network_mode: host
     environment:
@@ -73,13 +74,19 @@ services:
       DISCOGS_TOKEN: ${DISCOGS_TOKEN}
       SOCKS_PROXY_URL: ${SOCKS_PROXY_URL}
       MUSIC_DIR: /music
-      # System E acquisition is intentionally disabled by default. To enable it
-      # an operator must build with INSTALL_YTDLP=true and set all three runtime
-      # gates below; no acquisition happens merely from graph discovery.
-      # MUZICK_ACQUISITION_ENABLED: "true"
-      # MUZICK_ACQUISITION_YTDLP_PATH: /usr/bin/yt-dlp
-      # MUZICK_ACQUISITION_ALLOWED_HOSTS: example.org
-      # MUZICK_ACQUISITION_DIR: .recommendations
+      # System E acquisition, enabled. The allow-list is the only thing deciding
+      # where audio may come from, and it binds search-resolved URLs too.
+      # `www.youtube.com` is what yt-dlp reports as webpage_url for a ytsearch
+      # hit. Narrow this list to shrink the blast radius; empty it to stop
+      # acquisition without a rebuild.
+      MUZICK_ACQUISITION_ENABLED: "true"
+      MUZICK_ACQUISITION_YTDLP_PATH: /usr/bin/yt-dlp
+      MUZICK_ACQUISITION_ALLOWED_HOSTS: www.youtube.com
+      MUZICK_ACQUISITION_DIR: .recommendations
+      #
+      # Candidate generation crons (defaults shown, both daily).
+      # NEW_RELEASE_CRON: "30 5 * * *"
+      # RECOMMENDATION_CRON: "30 6 * * *"
       # Hard-deletion gates for the dislike lifecycle (invariant §C). All three
       # default to the safe value inside cleanup.service.ts; they are listed here
       # as documentation and are intentionally left unset.