security: add client-side input validation to youtube HTML pages

Add a defense-in-depth validation layer to both public/youtube.html and
public/youtube_meta.html. Previously, parameters read from the URL hash
were passed directly to the YouTube IFrame API without any client-side
checks, relying solely on the upstream Lua layer for sanitization.

Author: CattoGamer

public/youtube.html

@@ -75,8 +75,12 @@
 		};
 
 		function onYouTubeIframeAPIReady() {
-			const vid = getParameter('v') || 'dQw4w9WgXcQ';
-			const startTime = parseFloat(getParameter('t')) || 0;
+			const rawVid = getParameter('v');
+			const vid = (rawVid && /^[a-zA-Z0-9_-]{11}$/.test(rawVid))
+				? rawVid
+				: 'dQw4w9WgXcQ';
+
+			const startTime = Math.max(0, parseFloat(getParameter('t')) || 0);
 
 			createPlayer(vid, startTime);
 		}

public/youtube_meta.html

@@ -74,7 +74,10 @@
 		};
 
 		function onYouTubeIframeAPIReady() {
-			const vid = getParameter('v') || 'dQw4w9WgXcQ';
+			const rawVid = getParameter('v');
+			const vid = (rawVid && /^[a-zA-Z0-9_-]{11}$/.test(rawVid))
+				? rawVid
+				: 'dQw4w9WgXcQ';
 
 			createPlayer(vid);
 		}