chore(docker): pin yt-dlp and twitter-api-client versions to match Nix

- yt-dlp: pip install yt-dlp → yt-dlp==2026.8.19 (matches flake.nix pin)
- twitter-api-client: unpinned → 0.10.22 (matches flake.nix)
- docs: add Docker subsection to 'Keeping yt-dlp fresh' explaining that
  rebuilding the image is the Docker equivalent of the Nix/self-update
  paths, and that there is no in-container yt-dlp update path

Dockerfile

@@ -73,8 +73,8 @@ RUN npm install -g single-file-cli
 # conflicts with Debian's system Python packages.
 RUN python3 -m venv /opt/archivr-venv \
     && /opt/archivr-venv/bin/pip install --no-cache-dir \
-        yt-dlp \
-        twitter-api-client
+        "yt-dlp==2026.8.19" \
+        "twitter-api-client==0.10.22"
 
 # Download Chromium extensions used during headless captures.
 # uBlock Origin Lite (MV3) — ad/tracker blocking.

docs/README.md

@@ -319,6 +319,15 @@ nix build .#archivr-server
 git commit -am "chore(nix): yt-dlp OLD → $NEW"
 ```
 
+**4. Docker:** yt-dlp is pinned to a specific version in the `Dockerfile` (`pip install "yt-dlp==<version>"`), matching the Nix pin. To update, bump the version string in the `Dockerfile` venv install step to match the new Nix version, then rebuild:
+
+```sh
+docker build -t archivr-server .
+docker compose up -d
+```
+
+There is no in-container self-update path — `archivr yt-dlp update` writes to a host state directory that does not survive container restarts. Rebuild the image when captures start returning HTTP 403.
+
 ## Deployment
 
 ### Security