use remote cipher, disable oauth, rename lavalink config to .yaml

README.md

@@ -24,7 +24,7 @@ bot with a few fun slash commands and music playback powered by
 
 The bot is just a **Lavalink client** — actual audio is streamed by a separate
 **Lavalink v4 server** that runs alongside it (started with Docker). YouTube support
-comes from the `youtube-plugin`, configured in `lavalink/application.yml`.
+comes from the `youtube-plugin`, configured in `lavalink/application.yaml`.
 
 - Bot: Java + Gradle (JDA 6, `lavalink-client`)
 - Music server: Lavalink v4 via `docker-compose.yaml`
@@ -120,7 +120,7 @@ you don't set `LAVALINK_URI` yourself here.
 Some tracks — age-restricted ones, and anything YouTube decides to gate behind
 "Sign in to confirm you're not a bot" — won't load on the anonymous clients. The
 `TV` client can play them, but only with a linked Google account, so
-`lavalink/application.yml` enables the plugin's OAuth flow. **Use a throwaway
+`lavalink/application.yaml` enables the plugin's OAuth flow. **Use a throwaway
 Google account: Google does ban accounts for this.**
 
 One-time setup:
@@ -154,4 +154,4 @@ in the client list and only gets used when the others are refused.
 
 - Queue state is kept in memory, so it resets if the bot restarts.
 - YouTube occasionally breaks playback when Google changes its player. The fix is usually
-  bumping the `youtube-plugin` version in `lavalink/application.yml` and restarting the server.
+  bumping the `youtube-plugin` version in `lavalink/application.yaml` and restarting the server.