feat(web): embedURL helper for privacy-friendly nocookie embeds

Validates an 11-char YouTube id and returns the youtube-nocookie embed
URL, or ("", false) so callers omit a broken iframe. Table-driven test.

internal/web/view.go

@@ -1,6 +1,7 @@
 package web
 
 import (
+	"regexp"
 	"strings"
 	"time"
 
@@ -9,6 +10,21 @@ import (
 	"gitea.d-ma.be/mathias/tapir/internal/adapters/store"
 )
 
+// youtubeIDRe matches a canonical 11-char YouTube video id (the provider's
+// base64url alphabet). Anything else is rejected so we never emit a broken
+// embed src.
+var youtubeIDRe = regexp.MustCompile(`^[A-Za-z0-9_-]{11}$`)
+
+// embedURL builds a privacy-friendly nocookie embed URL for a YouTube video id.
+// It returns ("", false) for any id that isn't a valid 11-char YouTube id, so
+// the caller can omit the embed instead of rendering a broken iframe.
+func embedURL(providerVideoID string) (string, bool) {
+	if !youtubeIDRe.MatchString(providerVideoID) {
+		return "", false
+	}
+	return "https://www.youtube-nocookie.com/embed/" + providerVideoID, true
+}
+
 // actionVerbs is the fixed, ordered set of action toggles rendered in the button
 // group. It mirrors the store's allowed actions (store/actions.go); order here is
 // the display order, not the store's.