feat: add dark source inspection interface

docs/SECURITY.md

@@ -0,0 +1,63 @@
+# Security
+
+## Trust model
+
+The submitted URL and all remote metadata are untrusted. yt-dlp and FFmpeg
+process attacker-controlled network content and must not have host privileges
+or access to unrelated files and services. The current development build is
+not ready for public exposure.
+
+## Controls currently implemented
+
+- port bound only to `127.0.0.1`
+- non-root, read-only container with a small `/tmp` tmpfs
+- all Linux capabilities dropped and `no-new-privileges` enabled
+- yt-dlp plugins disabled and configuration files ignored
+- inspection only; media download disabled
+- playlists and multi-video results rejected
+- only HTTP/HTTPS URLs on ports 80/443 accepted
+- URL credentials rejected
+- initially resolved IPv4 and IPv6 addresses must all be globally routable
+- raw signed media URLs omitted from API responses
+- remote metadata inserted into the interface as text, not HTML
+
+## Required before download jobs
+
+- maximum source duration and estimated output size
+- per-job timeout and cancellation
+- one concurrent worker job initially
+- bounded CPU, memory, process, and temporary-storage use
+- randomized job directories and server-generated filenames
+- no user-controlled output templates or command fragments
+- FFmpeg/ffprobe validation of completed artifacts
+- safe handling of partial files and failed merges
+- automatic expiry and deletion
+- durable job recovery after process or container restarts
+- logs that exclude signed URLs, cookies, and credentials
+
+## Required before Internet deployment
+
+- Cloudflare Access deny-by-default policy
+- Cloudflare Tunnel with Access-token validation at the origin
+- no directly reachable origin application port
+- request-rate and body-size limits
+- explicit production configuration validation
+- dependency and container-image update procedure
+
+## SSRF limitation
+
+Initial-host validation is necessary but incomplete. Extractors may follow
+redirects and retrieve manifests, APIs, or media from additional hosts. DNS
+answers can also change between validation and connection.
+
+Before Internet deployment, outbound traffic from the processing service must
+be restricted at the network layer so private, loopback, link-local, multicast,
+and infrastructure-metadata destinations cannot be reached. URL validation is
+an additional layer, not the sole SSRF defense.
+
+## Deferred features
+
+Browser cookies and authenticated source accounts are excluded. A cookie file
+is effectively an account credential. Supporting one requires encrypted secret
+handling, isolated injection, redacted logging, rotation, and a deliberate
+account-compromise risk review.