Replaces instaloader with yt-dlp via subprocess (same pattern as YouTube).
Drops INSTAGRAM_PASSWORD requirement — cookies come from the user's
browser via --cookies-from-browser.

Config schema: instagram.username + INSTAGRAM_PASSWORD → instagram.browser
(legacy keys silently discarded on load).

See docs/building/journal/2026-04-29-instagram-yt-dlp-migration.md for
the full decision record.