fix(website-gen): support video assets and YouTube/Vimeo embeds

[ehsan6sha]

Summary

Fixes the AI website generator silently dropping video assets, and adds YouTube/Vimeo embedding.

Root cause: every video extension had a 0-byte size cap in websiteMaxFileSizeBytesForExt, so _uploadPhase skipped videos as "unsupported type" before upload — they never got a CID, were filtered out of the asset payload, and never reached Claude. Separately, the system prompt gave no <video> guidance and forbade external embeds.

Changes

lib/core/services/website_prompt_builder.dart, lib/core/services/website_service.dart, lib/web/services/web_website_service.dart:

• Whitelist browser-playable video (.mp4/.webm/.mov/.m4v/.ogv) with a new kWebsiteMaxVideoBytes (150MB); non-playable containers (.mkv/.avi/.wmv/.flv) stay unsupported by design so users don't publish a clip that won't play.
• Raise the per-job total cap 50MB → 200MB (fits one ~110MB+ video plus ~50MB of other assets). Video is uploaded unencrypted for hosting and referenced by URL only — its bytes are never sent to the AI backend.
• System-prompt guidance: embed a video asset with an HTML5 <video controls> player (never <img>); embed a referenced YouTube/Vimeo link as a responsive 16:9 iframe — the single permitted external resource, with an explicit host allowlist, loading="lazy", referrerpolicy, and no autoplay.
• Skip messages now report the actual cap (native + web) instead of a hardcoded "50MB".

The uploaded video streams from the range-capable dweb.link gateway (Content-Type set from the extension on PUT), so <video> plays and seeks.

Pairs with the pinning-service backend PR (detectMedia/prompt).

Review

Reviewed by GLM-5.2 (Cursor/Kimi/MiMo were unavailable this session — quota / account-gating). Applied its P1 fixes: cap headroom, de-contradicted the "no external links" wording, hardened the iframe. dart analyze clean.

Recommended follow-ups (from the review; intentionally out of scope here)

• Generator security hardening (rated P0 in the review): inject a <meta> CSP (frame-src allowlist) into generated pages and a deterministic post-generation iframe-src allowlist sanitizer (YouTube/Vimeo only). These harden a pre-existing gap (the generator already permits unsanitized inline JS), and a CSP risks breaking existing generated sites — so they warrant their own tested PR rather than riding along here.
• Web large-file OOM: the unencrypted upload buffers the whole file in memory before the PUT; a chunked/streaming upload is the real fix for large video on the web build. (Native is fine.)
• Magic-byte sniff to defend against extension spoofing (renamed non-video → wrong <source> type → silent playback failure).

Verification

Import a ~110MB .mp4 into a generated website → it uploads (not skipped as unsupported/too-large), the generated HTML contains <video controls> with a dweb.link src, and the clip plays and seeks on the published site. Paste a YouTube link in the prompt → a responsive iframe embed appears. Confirm a normal (non-generator) upload still plays (regression).

🤖 Generated with Claude Code