yt-dlp for page links in every Link mode; app icon and Linux launcher entry

yt-dlp: a managed, checksum-verified, daily-updated yt-dlp in the app and
the dedicated server (--[no-]yt-dlp, --yt-dlp-dir). Pasted links are
probed: direct files stay links, pages are resolved for title, uploader,
duration and thumbnail. Everyone fetches it: mpv's ytdl hook on the
managed copy. I pass it on / the server fetches it: the best single-file
format, re-resolved once when its URL expires. Relay names never split
the /r/ path; viewers of server-fetched pages wait for the relay to go
live. No wire change.

Icon: two stars orbiting a play button (assets/icon/icon.svg, PNGs, the
Windows .ico). GTK app id moe.senkochan.watch_together; release builds
install their .desktop file and icons into ~/.local/share so Wayland
shows the icon; the window icon is set for X11. README shows the icon.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/PROTOCOL.md

@@ -228,13 +228,16 @@ state media.relay = {"source":"m2","live":true}   or {"fetch":true,"live":true}
   `url` (else `relay fetch needs an http(s) url`), which the server keeps
   to itself, and a server with a password (else `server fetch needs a
   server password`: an open server would fetch any address it can reach
-  for anyone). Any later swap ends the relay.
+  for anyone). A web page `url` is read through the server's yt-dlp; when
+  the server cannot read the link, the swapper later gets `The server
+  can't fetch this link: <reason>`. Any later swap ends the relay.
 - `state.media.relay.source`: member id of the source (absent with
   `fetch`). `live` (omitted when false): bytes can flow (the source's
   channel is connected, or the server could read the link).
 - `welcome.mediaUrl` for relayed media without `jellyfin`: this member's
   `/r/` URL; absent for the source itself (it plays its own copy). Clients build it after a swap like the `/m` one:
-  `http://<host>/r/default/<token>/<mediaId>/<name>` (name URL-encoded).
+  `http://<host>/r/default/<token>/<mediaId>/<name>` (name with `/` and
+  `\` made `_`, then URL-encoded; the server ignores it).
 - `GET /r/<sid>/<token>/<mediaId>/<name>`: the media, Range table as for
   `/m`. Errors: 401 bad token, 403 kicked, 404 not the current relayed
   media (a player still on an older `mediaId` gets 404, never the new