feat: add Pinchflat YouTube download manager to media stack

- Add Pinchflat service with Authelia SSO protection
- Configure download folder at /mnt/hidrive/users/valknar/Downloads/pinchflat
- Expose on pinchflat.media.pivoine.art
- Port 8945 with WebSocket support
- Protected by net-authelia middleware for secure access

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

arty.yml

@@ -78,7 +78,7 @@ envs:
     UTIL_JOPLIN_DB_NAME: joplin
     # PairDrop
     UTIL_DROP_TRAEFIK_HOST: drop.pivoine.art
-    # Media Stack (Jellyfin, Filestash)
+    # Media Stack (Jellyfin, Filestash, Pinchflat)
     MEDIA_TRAEFIK_ENABLED: true
     MEDIA_COMPOSE_PROJECT_NAME: media
     MEDIA_JELLYFIN_IMAGE: jellyfin/jellyfin:latest
@@ -86,6 +86,8 @@ envs:
     MEDIA_FILESTASH_IMAGE: machines/filestash:latest
     MEDIA_FILESTASH_TRAEFIK_HOST: filestash.media.pivoine.art
     MEDIA_FILESTASH_CANARY: true
+    MEDIA_PINCHFLAT_IMAGE: ghcr.io/kieraneglin/pinchflat:latest
+    MEDIA_PINCHFLAT_TRAEFIK_HOST: pinchflat.media.pivoine.art
     # Dev (Gitea + Coolify)
     DEV_TRAEFIK_ENABLED: true
     DEV_COMPOSE_PROJECT_NAME: dev