feat: inline YouTube embeds in feed and post detail

[mandolinman137]

Summary

• Play YouTube videos inline in the Large feed layout and post detail view, instead of bouncing out to YouTube.
• Click-to-play: each post shows the YouTube thumbnail with a play overlay; the youtube-nocookie.com iframe only loads after a tap, so scrolling never pings Google.
• Gated by the existing Embed External Media setting (same toggle as Redgifs) — no new setting.
• A small portal provider keeps a single iframe per video and reparents it over the currently-visible slot, so playback survives feed ↔ post detail navigation. Videos stop when the slot unmounts (e.g. virtualized scroll).
• Compact layout is intentionally unchanged — YouTube posts still render as a link thumbnail there.
• Removed the platformSupportsRedgif() gate on the Embed External Media toggle so it shows on web (YouTube doesn't need the native CORS bypass Redgifs does).

URL detection covers: youtube.com, youtu.be, m. / music. subdomains, youtube-nocookie.com, youtubekids.com, yt.be, country TLDs (.de, .co.uk, etc.), and /watch, /embed/, /v/, /shorts/, /live/ paths.

Test plan

• With Embed External Media on, Large feed: YouTube posts show a thumbnail + play overlay; tapping loads the iframe and autoplays.
• Tapping elsewhere on the post still navigates to post detail; the running video follows and keeps playing.
• Back-navigating to the feed keeps the video playing in place.
• Scrolling the video out of the virtualized feed unmounts it (playback stops, restarts from zero on scroll-back).
• With the setting off, YouTube posts render as a plain link preview in every layout.
• Compact layout is unchanged regardless of the setting.
• NSFW YouTube post renders through BlurOverlay like other media.
• DevTools Network: no requests to YouTube on scroll — only after tapping play, and only to youtube-nocookie.com.
• pnpm test and pnpm test:typecheck pass. 15 new unit tests cover the URL detector (including a rejection for lookalike hosts like youtube.evil.com).

Notes

• No CSP changes needed (index.html has no CSP today).
• YouTube Shorts URLs (/shorts/{id}) are matched; YouTube Music URLs on music.youtube.com also work.
• Lookalike-host rejection caught a real regex bug during review — /^youtube(?:\.[a-z]{2,4}){1,2}$/ was too permissive and matched youtube.evil.com; tightened to /^youtube\.(?:[a-z]{2,3}|(?:co|com)\.[a-z]{2})$/.

[mandolinman137]

Addresses part of #530