yt-dlp options are built four times independently, so fixes reach only one caller #435

Found while working on #432. app/pipeline/download.py constructs a YoutubeDL options dict in four separate places:

• expand_playlist (playlist expansion)
• _probe inside download (metadata probe)
• download itself (the audio fetch)
• _download_video_track (the MP4 export stream)

They already disagree. ffmpeg_location is set in two of them, noplaylist in three, progress_hooks in two. Any extraction-level option added to fix an import failure lands on whichever caller prompted the fix and silently misses the rest.

Two consequences visible today:

• MP4 export degrades silently. _download_video_track catches Exception, logs a warning, and continues audio-only. On any setup where format resolution fails, video export just stops working and nothing surfaces it to the user. Nobody would report this, because nothing tells them.
• Playlist import has the same gap. expand_playlist builds its own options and would need the same treatment separately.

Fix: one _base_ydl_opts() helper carrying the options that must be identical everywhere (allowed extractors, socket timeout, ffmpeg location, and anything extraction-related added later), with per-call overrides layered on top. The security-relevant options in particular should not be four copies that can drift.