Build ytstream: catalogue, retention, subscription mirror, proxy

Phases 1-4 of plan.md §13. Forked from youtube-automate as planned rather than
written from scratch: naming, NFO, auth, the admin UI, settings and the DB layer
came across largely unchanged, download.py is gone, and the pieces that only make
sense for a streaming library are new.

  api.py       YouTube Data API v3 client. The whole metadata path.
  strm.py      Materialising: a .strm, an .nfo and a thumbnail. Replaces the
               330-line download.py, because the job is writing a URL to a file.
  subsync.py   The subscription mirror, most of which is refusals.
  reap.py      Retention, rewritten around the 30-day window and min_keep_videos.
  discovery.py RSS polling plus an API-backed, resumable, bounded backfill.
  proxy/       The verified PoC, moved in with a systemd unit.

330 tests, all passing, no network and no yt-dlp in any of them. The suite leans
towards the failure paths, because that is where this design can actually hurt
someone: a 403 that looks like an unsubscribe, a video that ages out and comes
back, a title that never arrives. tests/test_proxy.py replaces the two standalone
scripts under proxy/ and now drives the real make_handler(mgr, ...) rather than the
PoC's make_handler(path, done), so routing and video-id validation are covered too.

Ran it end to end against the live API and it found three real bugs.

The first was mine and the tests caught it: strm.remove pruned empty directories
up to the media root, so a channel directory whose tvshow.nfo happened to be
missing would be deleted along with the season. It only looked safe because
tvshow.nfo normally stops the walk. The prune boundary is now the channel
directory explicitly.

The other two only showed up against real data, and they compounded. The backfill
inserted rows with no title and left the RSS poll to fill them in — but RSS returns
15 entries, which for Pitch Side spans 23 days against a 30-day window, so five of
twenty episodes were named after their video ids. Worse, strm.materialise wrote
that fallback back to the database as the title, which made the row look titled and
permanently disabled the repair path. Both fixed: playlistItems.list now requests
snippet as well as contentDetails, which costs the same single quota unit and
carries the title alongside the exact publish date, and the fallback is used for the
filename without being persisted. A title that does arrive late now also removes the
badly-named files and re-queues, so the episode is rewritten rather than keeping its
video-id name forever. Verified against the live API: all twenty Pitch Side episodes
now carry real titles.

Measured on the real account: 119 subscriptions queued for approval and none added
on the first sync, then a two-channel run backfilled and materialised 26 episodes in
under seven seconds.

Two deliberate departures from plan.md, both recorded there:

min_keep_videos defaults to 5 rather than being left as an open question. Without
it 52 of 117 measured channels are empty Jellyfin series that flicker in and out as
their single video crosses the retention line, and the plan already recommended it.

The Jellyfin refresh is a bare /Library/Refresh with a comment explaining why it
must stay that way. A normal scan makes zero media probes; FullRefresh does probe,
and at 400 episodes that is 400 cold starts.

Not yet done: no systemd units are installed (needs root — deploy/deploy.sh), the
admin UI has no routes for sources or the approval queue yet, and nothing has been
pointed at the real media root.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/test_settings.py

@@ -0,0 +1,125 @@
+"""Typed settings accessors and form validation."""
+
+import pytest
+
+from ytstream import settings as settings_module
+from ytstream.settings import DEFAULTS, Settings, validate, validate_all
+
+
+class TestAccessors:
+    def test_missing_key_returns_the_default(self, settings):
+        assert settings.get_int("retention_days") == 30
+        assert settings.get_int("min_keep_videos") == 5
+        assert settings.get_str("proxy_base_url") == "http://127.0.0.1:8099"
+
+    def test_unknown_key_never_raises(self, settings):
+        assert settings.get_str("no_such_key") == ""
+        assert settings.get_int("no_such_key") == 0
+
+    def test_set_then_get(self, settings):
+        settings.set("retention_days", "30")
+        assert settings.get_int("retention_days") == 30
+
+    def test_set_overwrites(self, settings):
+        settings.set("retention_days", "30")
+        settings.set("retention_days", "45")
+        assert settings.get_int("retention_days") == 45
+
+    def test_corrupt_integer_falls_back_to_the_default(self, settings):
+        settings.set("retention_days", "not a number")
+        assert settings.get_int("retention_days") == 30
+
+    def test_reads_are_not_cached(self, conn, settings):
+        """Rotating the API key must be nothing more than saving a new value —
+        no restart of the hourly job or the admin server."""
+        settings.set("youtube_api_key", "first")
+        assert settings.get_str("youtube_api_key") == "first"
+
+        # A second Settings object standing in for the other process.
+        other = Settings(conn)
+        other.set("youtube_api_key", "second")
+
+        assert settings.get_str("youtube_api_key") == "second"
+
+    def test_all_editable_covers_every_default(self, settings):
+        assert set(settings.all_editable()) == set(DEFAULTS)
+
+    def test_secrets_are_not_editable(self):
+        for key in settings_module.SECRET_KEYS:
+            assert key not in settings_module.EDITABLE
+
+    def test_both_api_keys_are_masked(self):
+        assert "youtube_api_key" in settings_module.MASKED_KEYS
+        assert "jellyfin_api_key" in settings_module.MASKED_KEYS
+
+    def test_download_era_settings_are_gone(self):
+        for gone in ("disk_cap_gb", "write_subs", "sub_langs", "sponsorblock_mark",
+                     "max_attempts", "backfill_days"):
+            assert gone not in DEFAULTS
+
+
+class TestValidation:
+    @pytest.mark.parametrize(
+        "key, value",
+        [
+            ("retention_days", "30"),
+            ("min_keep_videos", "0"),
+            ("min_keep_videos", "5"),
+            ("backfill_max_videos", "300"),
+            ("max_height", "1080"),
+            ("min_duration_seconds", "120"),
+            ("subsync_max_new", "25"),
+            ("subsync_missing_threshold", "3"),
+            ("jellyfin_url", "http://127.0.0.1:8096"),
+            ("pot_provider_url", "https://example.com:4416"),
+            ("proxy_base_url", "http://127.0.0.1:8099"),
+            ("youtube_api_key", ""),
+        ],
+    )
+    def test_accepts_good_values(self, key, value):
+        ok, _ = validate(key, value)
+        assert ok
+
+    @pytest.mark.parametrize(
+        "key, value",
+        [
+            ("retention_days", "abc"),
+            ("retention_days", "0"),
+            ("retention_days", "-5"),
+            ("min_keep_videos", "-1"),
+            ("max_height", "10"),
+            ("min_duration_seconds", "-1"),
+            ("jellyfin_url", "not-a-url"),
+            ("jellyfin_url", "ftp://host/"),
+            ("jellyfin_url", "http://"),
+            ("proxy_base_url", "nonsense"),
+        ],
+    )
+    def test_rejects_bad_values(self, key, value):
+        ok, message = validate(key, value)
+        assert not ok
+        assert message
+
+    def test_zero_missing_threshold_is_rejected(self):
+        """Zero would unsubscribe on the first absent response, which is exactly
+        the failure the threshold exists to prevent."""
+        ok, message = validate("subsync_missing_threshold", "0")
+        assert not ok
+        assert message
+
+    def test_validate_all_reports_each_bad_field(self):
+        errors = validate_all(
+            {"retention_days": "abc", "max_height": "1080", "jellyfin_url": "nope"}
+        )
+        assert set(errors) == {"retention_days", "jellyfin_url"}
+
+    def test_validate_all_ignores_unknown_keys(self):
+        assert validate_all({"not_a_setting": "x"}) == {}
+
+    def test_empty_api_keys_are_acceptable(self):
+        assert validate("jellyfin_api_key", "")[0]
+        assert validate("youtube_api_key", "")[0]
+
+    def test_whitespace_is_tolerated(self):
+        ok, _ = validate("retention_days", "  21  ")
+        assert ok