v0.1.26 — honest YouTube state + setup polish

Honest YouTube state + setup UX polish

Field-caught on a real multi-account Mac. Fixes and improvements:

• YouTube no longer falsely reports "signed out." With multiple signed-in
  Google accounts, the My Activity probe never said which account to use, so
  Google bounced to its account-chooser and the product mislabeled that as
  signed-out. The probe now sends the account (configurable
  plugins.youtube.authUser, default 0). When Google interposes an
  identity-verification page on programmatic access — which an established
  account does even with valid cookies — the product names that honestly
  (youtube_session_unverifiable) and routes to the official export import,
  instead of lying or erroring cryptically. The reliable route for YouTube
  history remains nutshell import youtube <google-export.zip>.
• Setup step wording: headers name the state ("YouTube My Activity — needs
  login") instead of a vague "needs attention," and the problem/fix lines no
  longer restate each other.
• Permission window: the draggable app icon now shows a persistent
  move-arrows badge and the standard open-hand drag cursor.

Product behavior is otherwise v0.1.25 (dual-architecture, macOS 14+). All v0.1.24
behavior gates still hold; the YouTube classification change is covered by new
regression tests and verified against a real multi-account browser. Install:
Homebrew tap or tarball, Apple Silicon + Intel. npm deferred.