feat(server): opt-in open write paths for self-authenticating handlers (#136)

[rowkav09]

Part of #136, slice 1b-i. The YouTube extension posts from a chrome-extension://… origin, so the local server's same-origin and session-cookie checks would refuse it. createHttpServer gets an openWritePaths option: a list of exact paths whose writes skip those two checks, because the handler authenticates them itself (the bridge from #395 checks the extension origin and the pairing token).

• Opt-in, and nothing passes it yet, so behaviour is unchanged.
• Exact path match only (/bridge/youtube/ or any other path keeps every check). Paths are validated at start-up.
• Open paths still must be application/json and are still capped by the body limit.

Security note: this is the only way around the write checks, and it's limited to exact paths whose handler does its own auth. The security lane is welcome to review.

Checks

• Tests: open path accepts an extension-origin JSON write even with a session secret, still refuses non-JSON, other paths unchanged, bad path option refused
• No secrets committed
• Scoped to feat: add YouTube playback as an optional provider plugin #136

[rowkav09]

/mira resume

[github-actions]

/mira pause

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!

[rowkav09]

No Mira review came in after /mira resume (Mira is still paused). Rebased, tests pass and every check is green. I reviewed it myself: exact-path opt-in only, JSON and body limit still enforced, nothing uses it yet. Merging with an explicit squash message.