feat(web): embedURL helper for privacy-friendly nocookie embeds

Validates an 11-char YouTube id and returns the youtube-nocookie embed
URL, or ("", false) so callers omit a broken iframe. Table-driven test.

internal/web/view.go

@@ -1,6 +1,7 @@
 package web
 
 import (
+	"regexp"
 	"strings"
 	"time"
 
@@ -9,6 +10,21 @@ import (
 	"gitea.d-ma.be/mathias/tapir/internal/adapters/store"
 )
 
+// youtubeIDRe matches a canonical 11-char YouTube video id (the provider's
+// base64url alphabet). Anything else is rejected so we never emit a broken
+// embed src.
+var youtubeIDRe = regexp.MustCompile(`^[A-Za-z0-9_-]{11}$`)
+
+// embedURL builds a privacy-friendly nocookie embed URL for a YouTube video id.
+// It returns ("", false) for any id that isn't a valid 11-char YouTube id, so
+// the caller can omit the embed instead of rendering a broken iframe.
+func embedURL(providerVideoID string) (string, bool) {
+	if !youtubeIDRe.MatchString(providerVideoID) {
+		return "", false
+	}
+	return "https://www.youtube-nocookie.com/embed/" + providerVideoID, true
+}
+
 // actionVerbs is the fixed, ordered set of action toggles rendered in the button
 // group. It mirrors the store's allowed actions (store/actions.go); order here is
 // the display order, not the store's.

internal/web/view_internal_test.go

@@ -0,0 +1,29 @@
+package web
+
+import "testing"
+
+func TestEmbedURL(t *testing.T) {
+	tests := []struct {
+		name    string
+		id      string
+		wantURL string
+		wantOK  bool
+	}{
+		{"valid 11-char id", "dQw4w9WgXcQ", "https://www.youtube-nocookie.com/embed/dQw4w9WgXcQ", true},
+		{"valid with dash and underscore", "a_b-cD12345", "https://www.youtube-nocookie.com/embed/a_b-cD12345", true},
+		{"empty", "", "", false},
+		{"too short", "abc", "", false},
+		{"too long", "dQw4w9WgXcQX", "", false},
+		{"invalid char", "dQw4w9WgXc!", "", false},
+		{"space", "dQw4w9WgX Q", "", false},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			gotURL, gotOK := embedURL(tt.id)
+			if gotURL != tt.wantURL || gotOK != tt.wantOK {
+				t.Errorf("embedURL(%q) = (%q, %v), want (%q, %v)",
+					tt.id, gotURL, gotOK, tt.wantURL, tt.wantOK)
+			}
+		})
+	}
+}