fix: restrict web ingest to official YouTube hosts and bound submission size

The submit form's URL validation accepted any http/https host. Restrict it
to an explicit allowlist of official YouTube hosts using normalized,
exact hostname comparison (no substring/suffix matching), reject embedded
userinfo and malformed URLs, and add server-side length bounds for the URL,
submitter, note, and total request body.

README.md

@@ -927,8 +927,11 @@ PYTHONDONTWRITEBYTECODE=1 .venv/bin/python -m unittest discover -s tests -v
 
 - The web form is unauthenticated and listens on `0.0.0.0` by default. Restrict
   the published port with host firewall/network ACLs or place it behind an
-  authenticated reverse proxy. URL validation checks only the `http`/`https`
-  shape; yt-dlp performs the outbound request.
+  authenticated reverse proxy. Submitted URLs must use `http`/`https`, carry no
+  embedded userinfo, and resolve (by exact, normalized hostname match) to an
+  official YouTube host: `youtube.com`, `www.youtube.com`, `m.youtube.com`,
+  `music.youtube.com`, or `youtu.be`. URL, submitter, note, and total request
+  size are also server-side bounded. yt-dlp performs the outbound request.
 - MQTT username/password support is available, but application-level TLS is not
   configured here. Keep this connection on a trusted/protected network or add a
   separately managed secure tunnel/proxy, and grant the Controller only the