feat(providers): YouTube bridge and provider for the browser extension (#136)

[rowkav09]

Part of #136, slice 1a. Adds src/youtube-bridge.js, the app side of the YouTube browser extension. The scope was approved on #136: an MV3 extension, minimal permissions, a pairing token and a TTL. Nothing is wired into the HTTP server yet (that's 1b), so the app runs unchanged.

• receive({ method, headers, body }) accepts only POSTs from a browser-extension origin (chrome-extension://… / moz-extension://…) carrying the pairing token (Bearer, constant-time compare). Web pages get 403 and wrong tokens 401.
• Strict event schema: 11-character video ID, title and channel length caps, and thumbnails only from https YouTube image hosts. Unknown keys are refused.
• Freshness: a tab that stops reporting for 30 s is dropped, so a closed browser goes idle. At most 16 tabs are tracked.
• With several tabs, the most recently started one wins, and a heartbeat from an older tab doesn't steal it back. If nothing is playing, the most recently paused tab shows as paused.
• Ads, Shorts and "stopped" clear the tab. Live streams have no position or duration.
• provider: YouTube Music maps to track (Listening). Other videos are unknown rather than claiming TV or film metadata.

Next: 1b wires /bridge/youtube into the local server, with no session cookie and its own auth. Then the extension skeleton.

Checks

• Tests: playback, origin, token and schema rejections, ads/Shorts/stop, TTL, tab priority, live
• No secrets committed
• Scoped to feat: add YouTube playback as an optional provider plugin #136

[rowkav09]

/mira resume

[github-actions]

/mira pause

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!

[rowkav09]

No Mira review came in after /mira resume (Mira is still paused). Rebased onto main, tests pass and every check is green. I reviewed it myself: extension origin plus token auth, strict schema, TTL, not wired into the server yet. Merging with an explicit squash message (no co-author trailer).