feat(discovery): acquire recommendations that keep their names

Acquisition ran yt-dlp without --embed-metadata, so every download
arrived untagged. The scanner then stored the video id as the title and
"Unknown Artist" as the artist, the vetted-candidate tag check rejected
the mismatch, and all 18 acquired tracks were hidden and retired.

- Pass --embed-metadata so downloads carry real tags.
- Let a scan take fallback title/artist from the candidate, for sources
  that still ship untagged files.
- Install Deno alongside yt-dlp: YouTube guards some formats with a JS
  challenge yt-dlp must execute, and no other runtime is enabled.
- Dedupe candidates by artist and title. The (source, external_id) key
  misses the same song reaching us under two Deezer release ids.

Also carries the in-flight discovery work this builds on: the
Recommendations page replacing Discover, the discovery source service,
and the acquisition spec tests.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

workers/Dockerfile

@@ -2,8 +2,21 @@ FROM node:20-slim
 # yt-dlp is intentionally opt-in. Enabling its image build alone does not make
 # acquisition live: the worker additionally requires explicit runtime gates.
 ARG INSTALL_YTDLP=false
-RUN apt-get update && apt-get install -y ffmpeg \
-    && if [ "$INSTALL_YTDLP" = "true" ]; then apt-get install -y yt-dlp; fi \
+# Debian's yt-dlp package lags years behind and fails on current YouTube, so
+# take the self-contained upstream binary instead. It bundles its own Python.
+# ponytail: tracks latest; pin the tag here if a release ever breaks the loop.
+RUN apt-get update && apt-get install -y ffmpeg curl unzip \
+    && if [ "$INSTALL_YTDLP" = "true" ]; then \
+         curl -fsSL https://github.com/yt-dlp/yt-dlp/releases/latest/download/yt-dlp_linux \
+           -o /usr/bin/yt-dlp \
+         && chmod 755 /usr/bin/yt-dlp \
+         && /usr/bin/yt-dlp --version \
+         # YouTube guards some formats with an obfuscated JS challenge that
+         # yt-dlp must execute. Deno is the only runtime it enables by default,
+         # and without one those videos fail extraction.
+         && curl -fsSL https://deno.land/install.sh | DENO_INSTALL=/usr/local sh -s -- --yes \
+         && deno --version; \
+       fi \
     && rm -rf /var/lib/apt/lists/*
 WORKDIR /app
 COPY package*.json ./