v2.0.1 feat: web UI, LLM abstraction, TikTok settings

[hongphuc5497]

Summary

Adds a web UI dashboard and HTTP server to AutoCreateVideo, enabling browser-based video generation from news URLs. Also adds TikTok settings panel with persistence.

New:

• Express-free HTTP server (src/server.ts, 572 lines) serving UI at localhost:4317
• Web UI dashboard with URL input, output listing, job logs, and TikTok settings panel
• LLM provider abstraction: Anthropic, OpenAI-compatible, and DeepSeek via LLM_PROVIDER env var
• Real-time job progress via SSE (snapshot/log/progress/status events)
• Article content web fetcher with HTML extraction and og:image detection
• TikTok settings CRUD (avatar URL, handle, followers) with persistence to output/.ui-settings.json

Changed:

• Config supports LLM_PROVIDER, LLM_API_KEY, LLM_MODEL, LLM_ENDPOINT
• Pipeline respects TIKTOK_ENABLED toggle — disables TikTok card, avatar fetch, outro hold when off
• Script schema uses discriminated union templates (6 types: hook, comparison, stat-hero, feature-list, callout, outro)
• HTML composer conditionally renders TikTok handle and outro card
• LLM_API_KEY validated at client creation time, not config load — existing pipeline/rerender flows don't require LLM config
• Non-force audit fix for transitive protobufjs advisory

Validation

• npm test — 55 tests pass (10 files)
• npm run typecheck
• npm run build
• Browser smoke: http://127.0.0.1:4317/
• API smoke: GET/PUT /api/settings, 403 on hidden paths

Test Coverage

AI-assessed coverage: ~21% on new code paths (user accepted risk). Existing 55 tests pass. 10 test files covering server helpers, config loading, script schema, HTML composer, TTS clients, and SFX selector.

Pre-Landing Review

No critical issues. XSS: escapeHtml used consistently. Shell injection: spawn with arg arrays, no shell:true. LLM output: Zod-validated before disk persistence. Path traversal: blocked in both safeOutputPath and serveStatic.

Plan Completion

Design doc exists (hongphuc-codex-deps-ui-refresh-design-20260520-005443.md). 11 eng review tasks (PipelineError, SSE error, progress stages, etc.) deferred — branch code pre-dates planning. Shipping as-is for real-world friend testing.

🤖 Generated with Claude Code