feat: zoom-to-video, mute, YouTube Trusted Types fix, recovery paths

## Zoom to video
New global hotkey (Alt+Shift+V) and strip button that finds the largest
<video> on the page and crops to its bounding rect. If the player is
offscreen the page smooth-scrolls to center it first, then the crop
animates in. Ephemeral (doesn't persist) so a missing/relocated video
on the next visit doesn't strand a stale crop; on toggle-off any
manual crop the user had saved is restored intact. If no usable
video exists the button flashes red for 700ms.

## Mute
Alt+Shift+M and a strip speaker button that mutes every <video> and
<audio> on the page. Icon reflects real state — a volumechange
listener on media elements (attached via MutationObserver so it
catches lazy-loaded players too) keeps the UI in sync with page-side
mute toggles like YouTube's `M` key.

## Trusted Types / YouTube compatibility
YouTube (and much of Google, GitHub, many banks) ships
`Content-Security-Policy: require-trusted-types-for 'script'`, which
throws a TypeError on every `element.innerHTML = ...` assignment.
Our IIFE died on the first such assignment, leaving the page with no
strip, no hotzone, and no recovery affordances. Fix: new `setInner`
helper with a two-tier strategy — registers a named Trusted Types
policy if the host CSP allows it, otherwise uses DOMParser (whose
output document isn't subject to the page's CSP). All 15 innerHTML
assignments routed through the helper.

## Recovery affordances
- `Alt+Shift+S` global hotkey: force-shows the strip. Reparents the
  container into the current home, un-hides it, cancels any pending
  hide timer, releases stuck click-through, and calls showStrip().
- Tray: new "Reload Page" item (hard Rust-side reload, the nuclear
  option when JS is hung) and "Show Control Strip" item (mirrors the
  hotkey via Rust eval).
- DevTools enabled in release builds (Tauri `devtools` feature) so
  power users can inspect their own sessions.

## Fullscreen awareness
New `fullscreenchange` listener reparents the container into the
active fullscreen element. The Fullscreen API bypasses z-index
(only the fullscreen element's descendants render), so without this
the strip is invisible during YouTube/Plex fullscreen.

## Supporting refactors
- Mute observer only calls `updateMuteIcon` when video/audio nodes
  are actually added or removed, not on every DOM mutation — saves
  significant main-thread CPU on YouTube-scale churn.
- applyCrop/removeCrop now take an explicit `persist` flag so
  ephemeral (zoom-to-video) and saved (manual) crops don't step on
  each other's config state.

## Version bump
1.2.0 → 1.3.0 across Cargo.toml, tauri.conf.json, package.json.

Verified: cargo test (41 pass), clippy clean, release build clean,
runtime smoke-tested on YouTube including the previously-broken
hijack case.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: davidtorcivia

package.json

@@ -1,6 +1,6 @@
 {
   "name": "floatview",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "description": "A minimal floating browser window for streaming media on a secondary monitor",
   "scripts": {
     "tauri": "tauri",

src-tauri/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "floatview"
-version = "1.2.0"
+version = "1.3.0"
 description = "A minimal floating browser window for streaming media"
 authors = ["David Torcivia"]
 license = "MIT"
@@ -10,7 +10,7 @@ edition = "2021"
 tauri-build = { version = "2", features = [] }
 
 [dependencies]
-tauri = { version = "2", features = ["tray-icon"] }
+tauri = { version = "2", features = ["tray-icon", "devtools"] }
 tauri-plugin-single-instance = "2"
 tauri-plugin-global-shortcut = "2"
 tauri-plugin-updater = "2"

src-tauri/src/config.rs

@@ -55,6 +55,29 @@ pub struct HotkeyConfig {
     pub media_play_pause: String,
     pub media_next: String,
     pub media_previous: String,
+    #[serde(default = "default_media_mute")]
+    pub media_mute: String,
+    #[serde(default = "default_zoom_video")]
+    pub zoom_video: String,
+    /// Emergency "force-show the control strip" hotkey. Always-works
+    /// escape hatch for pathological page states (SPA DOM wipes, stray
+    /// fullscreen layers, click-through left on). See also the
+    /// [`ZOOM_VIDEO_SCRIPT`](crate::injection::ZOOM_VIDEO_SCRIPT)
+    /// sibling scripts.
+    #[serde(default = "default_show_strip")]
+    pub show_strip: String,
+}
+
+fn default_media_mute() -> String {
+    "Alt+Shift+M".to_string()
+}
+
+fn default_zoom_video() -> String {
+    "Alt+Shift+V".to_string()
+}
+
+fn default_show_strip() -> String {
+    "Alt+Shift+S".to_string()
 }
 
 impl Default for HotkeyConfig {
@@ -68,6 +91,9 @@ impl Default for HotkeyConfig {
             media_play_pause: "Alt+Shift+P".to_string(),
             media_next: "Alt+Shift+Right".to_string(),
             media_previous: "Alt+Shift+Left".to_string(),
+            media_mute: default_media_mute(),
+            zoom_video: default_zoom_video(),
+            show_strip: default_show_strip(),
         }
     }
 }

src-tauri/src/config_io.rs

@@ -96,6 +96,9 @@ pub fn sanitize_config(mut config: AppConfig) -> AppConfig {
     config.hotkeys.media_next = sanitize_hotkey(&config.hotkeys.media_next, "Alt+Shift+Right");
     config.hotkeys.media_previous =
         sanitize_hotkey(&config.hotkeys.media_previous, "Alt+Shift+Left");
+    config.hotkeys.media_mute = sanitize_hotkey(&config.hotkeys.media_mute, "Alt+Shift+M");
+    config.hotkeys.zoom_video = sanitize_hotkey(&config.hotkeys.zoom_video, "Alt+Shift+V");
+    config.hotkeys.show_strip = sanitize_hotkey(&config.hotkeys.show_strip, "Alt+Shift+S");
 
     let mut deduped_bookmarks = Vec::new();
     let mut seen_bookmarks = HashSet::new();

src-tauri/src/hotkeys.rs

@@ -14,7 +14,10 @@ use tracing::{error, warn};
 use crate::actions::{
     do_media_action, do_opacity_change, do_toggle_always_on_top, do_toggle_locked,
 };
-use crate::injection::{MEDIA_NEXT_SCRIPT, MEDIA_PLAY_PAUSE_SCRIPT, MEDIA_PREVIOUS_SCRIPT};
+use crate::injection::{
+    MEDIA_MUTE_SCRIPT, MEDIA_NEXT_SCRIPT, MEDIA_PLAY_PAUSE_SCRIPT, MEDIA_PREVIOUS_SCRIPT,
+    SHOW_STRIP_SCRIPT, ZOOM_VIDEO_SCRIPT,
+};
 use crate::state::AppState;
 
 /// Lowercased keyname → `Code` lookup. Populated lazily on first parse.
@@ -145,6 +148,21 @@ pub fn register_hotkeys(app: &AppHandle) {
         let app_h = app.clone();
         move || do_media_action(&app_h, MEDIA_PREVIOUS_SCRIPT)
     });
+
+    register_one(app, &hotkeys.media_mute, "media_mute", {
+        let app_h = app.clone();
+        move || do_media_action(&app_h, MEDIA_MUTE_SCRIPT)
+    });
+
+    register_one(app, &hotkeys.zoom_video, "zoom_video", {
+        let app_h = app.clone();
+        move || do_media_action(&app_h, ZOOM_VIDEO_SCRIPT)
+    });
+
+    register_one(app, &hotkeys.show_strip, "show_strip", {
+        let app_h = app.clone();
+        move || do_media_action(&app_h, SHOW_STRIP_SCRIPT)
+    });
 }
 
 /// Internal: parse + register one hotkey binding, logging on failure.