feat(web): expose reviewed YouTube queue catalog

[John-Ryan21337]

Outcome

Adds a bounded, immutable catalog for the three reviewed YouTube queue assets from #49, using the strict parser from #50.

Included catalogs

• Japanese music: 71 accepted unique video IDs.
• EDM: 30 accepted unique video IDs.
• K-pop: 8 accepted unique video IDs.

The catalog preserves the parser's bounded issue counts for duplicate and malformed source entries. It does not guess or repair malformed video IDs.

Authority and privacy boundaries

• Public values contain normalized video IDs, counts, and bounded diagnostics only.
• Raw source URLs are not retained in loaded catalog results.
• Source text and source-count ledgers remain private to the module.
• Catalog records, result wrappers, nested errors, issue objects, and internal source records are frozen at runtime.
• Unknown catalog IDs return a bounded error without echoing caller-controlled input.
• No network request, storage write, DOM access, embed, playback, or media activation occurs.

Review history

An independent mutation-authorized audit found that the first implementation used readonly TypeScript types without freezing all runtime wrappers and private ledgers. The second commit repairs those gaps and adds regressions for authority shape, count agreement, nested immutability, mutation rejection, fresh-load isolation, unknown-ID non-echo, and URL non-retention.

Verification

• Parser and catalog tests: 74/74 passed.
• Web typecheck: passed.
• Repository typecheck: 9/9 packages passed.
• Formatting and format check: passed.
• Exact-file lint: passed.
• Repository lint: passed with existing unrelated warnings only.
• Diff check: passed.
• Two unrelated five-second script tests timed out only under full parallel load; their isolated rerun passed 7/7 in 319 ms.

Review shape

This branch has the visible ancestry of Cafe #49 and #50. Its unique change is two files and two commits: the catalog and its independent audit repair. It still does not add the player, settings selection, persistence, upload, or replacement workflow.