enable youtube oauth for login-gated tracks

README.md

@@ -115,6 +115,41 @@ bot image and runs it alongside Lavalink. You only need Docker — no JDK.
 The bot connects to Lavalink over the internal Docker network automatically, so
 you don't set `LAVALINK_URI` yourself here.
 
+## YouTube tracks that need a login
+
+Some tracks — age-restricted ones, and anything YouTube decides to gate behind
+"Sign in to confirm you're not a bot" — won't load on the anonymous clients. The
+`TV` client can play them, but only with a linked Google account, so
+`lavalink/application.yml` enables the plugin's OAuth flow. **Use a throwaway
+Google account: Google does ban accounts for this.**
+
+One-time setup:
+
+```bash
+docker compose up -d lavalink
+docker compose logs -f lavalink
+```
+
+The logs print something like:
+
+```
+OAUTH INTEGRATION: To give youtube-source access to your account, go to
+https://www.google.com/device and enter code XXXX-XXXX
+```
+
+Open that page, enter the code, and approve. Lavalink then logs the refresh
+token. Put it in `.env`:
+
+```
+PLUGINS_YOUTUBE_OAUTH_REFRESHTOKEN=<the token from the logs>
+```
+
+and `docker compose up -d lavalink` again. Compose already passes `.env` into the
+Lavalink container, and the variable name maps onto
+`plugins.youtube.oauth.refreshToken`, so later restarts skip the device flow.
+Everything that already worked keeps using the anonymous clients — `TV` is last
+in the client list and only gets used when the others are refused.
+
 ## Notes
 
 - Queue state is kept in memory, so it resets if the bot restarts.