feat(web): embedURL helper for privacy-friendly nocookie embeds

Validates an 11-char YouTube id and returns the youtube-nocookie embed
URL, or ("", false) so callers omit a broken iframe. Table-driven test.

internal/web/view_internal_test.go

@@ -0,0 +1,29 @@
+package web
+
+import "testing"
+
+func TestEmbedURL(t *testing.T) {
+	tests := []struct {
+		name    string
+		id      string
+		wantURL string
+		wantOK  bool
+	}{
+		{"valid 11-char id", "dQw4w9WgXcQ", "https://www.youtube-nocookie.com/embed/dQw4w9WgXcQ", true},
+		{"valid with dash and underscore", "a_b-cD12345", "https://www.youtube-nocookie.com/embed/a_b-cD12345", true},
+		{"empty", "", "", false},
+		{"too short", "abc", "", false},
+		{"too long", "dQw4w9WgXcQX", "", false},
+		{"invalid char", "dQw4w9WgXc!", "", false},
+		{"space", "dQw4w9WgX Q", "", false},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			gotURL, gotOK := embedURL(tt.id)
+			if gotURL != tt.wantURL || gotOK != tt.wantOK {
+				t.Errorf("embedURL(%q) = (%q, %v), want (%q, %v)",
+					tt.id, gotURL, gotOK, tt.wantURL, tt.wantOK)
+			}
+		})
+	}
+}