feat: Phase P reliability (YouTube extractor-args plumbing, signing + smoke-test docs)

- YouTube reliability: Settings.youtubePlayerClient + youtubePoToken ->
  one --extractor-args "youtube:player_client=...;po_token=..." group
  (accessArgs, unit-tested); advanced fields in Settings -> Network.
  Automatic WebView PO-token minting deferred (documented).
- docs/SMOKE-TEST.md: release-gate checklist for all shipped-but-untested
  OS wiring (cookies window, protocol/Send-to, scheduled sync, aria2c, proxy,
  tray/taskbar/pause-resume/terminal) — needs a human to run.
- docs/SIGNING.md: code-signing guide (CSC_LINK/CSC_KEY_PASSWORD, OV/EV,
  CI, HSM hook, verification). Build is signing-ready; needs a cert.
- i18n remains deferred (not faked).

typecheck + test (195) + build all clean. Roadmap: Phase P code shipped.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

ROADMAP.md

@@ -391,28 +391,30 @@ All in the main process. typecheck + test + `npm run build` clean.
       live by matching each card's text (DOM `display` toggle keyed off the root's children — no
       per-card refactor), with a "no settings match" hint.*
 
-## Phase P — Reliability, longevity & trust
+## Phase P — Reliability, longevity & trust ✅ (code shipped; cert + manual passes still required)
 
-The least glamorous, highest-leverage track: make sure what's *already shipped* actually works,
-keep YouTube downloads working as the platform tightens, and remove first-run friction.
+The least glamorous, highest-leverage track. The buildable code is done (typecheck + test +
+build clean); the parts that inherently need a human or a paid cert are delivered as artifacts.
 
-- [ ] **PO Token generation.** YTDLnis mints YouTube tokens in a WebView to dodge throttling
-      and "Sign in to confirm you're not a bot." This is becoming **required** for YouTube to
-      keep working at all. → reuse the existing persisted Electron `BrowserWindow`
-      (`persist:aerofetch-login` in `src/main/cookies.ts`) to host a token-minting script, or
-      support a PO-token provider, passed via `--extractor-args youtube:po_token=…`. A
-      longevity hedge more than a feature.
-- [ ] **Verify the shipped-but-untested OS wiring** (flagged across both parity tracks as
-      "reasoning + typecheck only"). A single real NSIS-install smoke-test pass over: the
-      cookies sign-in window export · the `aerofetch://` protocol + Explorer "Send to" · the
-      scheduled `--sync` + RSS fast-check (Phase J) · aria2c · proxy. Converts a lot of
-      "probably works" into "verified."
-- [ ] **Code signing.** The unsigned `.exe` triggers SmartScreen "Run anyway" — the single
-      biggest first-run friction for anyone you share it with. electron-builder `win` signing
-      (OV/EV cert); EV builds SmartScreen reputation fastest.
-- [ ] **i18n / language setting.** Carried over from Phase E (deferred). YTDLnis and Seal both
-      ship many languages. Large but optional — needs an i18n library + string extraction, with
-      translations arriving incrementally.
+- [x] **PO Token / YouTube reliability plumbing.** *Done: `Settings.youtubePlayerClient` +
+      `youtubePoToken` → one `--extractor-args "youtube:player_client=…;po_token=…"` group
+      (`accessArgs` in `buildArgs.ts`, unit-tested), with "advanced" fields in Settings → Network.
+      Lets a power user switch extraction client (`web_safari`/`tv`/`mweb`) or paste a token.*
+      **Deferred: automatic WebView token minting** (the YTDLnis headline) — the hard part;
+      this is the argv plumbing it would feed. Cookies remain the easier bot-check fix.
+- [x] **Verify the shipped-but-untested OS wiring.** *Can't be executed here (no real install).
+      Delivered as a release-gate checklist — [docs/SMOKE-TEST.md](docs/SMOKE-TEST.md) —
+      enumerating every untested path (cookies window, `aerofetch://` + Send-to, scheduled
+      `--sync` + RSS, aria2c, proxy, plus the new tray/taskbar/pause-resume/terminal) with exact
+      steps + expected results. **Still needs a human to run it.**
+- [x] **Code signing.** *Build is signing-ready: electron-builder picks the cert up from
+      `CSC_LINK` / `CSC_KEY_PASSWORD` with no yml change (unset = unsigned, as today). Documented
+      in [docs/SIGNING.md](docs/SIGNING.md) (OV vs EV, local + CI, HSM/EV hook, signature
+      verification). **Actual signing needs a purchased certificate.***
+- [ ] **i18n / language setting.** Still deferred — deliberately not faked. Shipping a language
+      picker that doesn't change anything would be misleading; doing it properly means wiring an
+      i18n library + extracting every string, with translations arriving incrementally. Tracked,
+      not started.
 
 ---