use remote cipher, disable oauth, rename lavalink config to .yaml

lavalink/application.yaml

@@ -32,9 +32,9 @@ plugins:
     enabled: true
     allowSearch: true     # enables the "ytsearch:" queries the bot falls back to
     # Tried in order; the first one that can load the track wins. TV is last
-    # because it needs a signed-in account (see oauth below), but it's the only
-    # client that plays age-restricted / "sign in to confirm you're not a bot"
-    # tracks, so it's the fallback when the others get rejected.
+    # because it's the heaviest option, but it's the only client that plays
+    # age-restricted / "sign in to confirm you're not a bot" tracks, so it's
+    # the fallback when the others get rejected.
     clients:
       - MUSIC
       - WEB
@@ -50,7 +50,18 @@ plugins:
       # so the device flow is skipped on every later start.
       #
       # Use a throwaway Google account. Google does ban accounts for this.
-      enabled: true
+      #
+      # Off for now: TV clears the login check anonymously for ordinary tracks,
+      # so a token only buys age-restricted ones. Flip to true (and do the
+      # device flow) if those turn out to matter.
+      enabled: false
+
+    # YouTube serves some regions a localized player script the plugin can't
+    # parse, which fails playback with "must find sig function". Hand the
+    # deciphering to a cipher server instead of doing it locally.
+    remoteCipher:
+      url: "https://cipher.kikkia.dev"
+      userAgent: "botinator"
 
 logging:
   level: