Available endpoints:
POST /unfurl/sse   - Public SSE unfurl (Turnstile + per-IP rate limit; API token bypasses both)
POST /yt-dlp       - Run yt-dlp with custom args (API token required)