feat: merge PR averygan#24 (yt-dlp fix) + PR averygan#3 (security hardening, memory leak, UX)

- Pin yt-dlp>=2026.3.17 to fix YouTube SABR 403 errors (fixes averygan#8)
- Add --upgrade-deps to reclip.sh venv setup
- Add URL validation (http/https only)
- Add format_id sanitization against yt-dlp flag injection
- Add job_id format validation
- Add path traversal protection on file serving
- Add non-root user in Dockerfile
- Add threading lock for jobs dict (race condition fix)
- Add job TTL auto-purge (1hr) + MAX_JOBS cap (500)
- Add /api/cleanup endpoint + frontend cleanup call after download
- Add structured logging + type hints
- Fix dlAll() to await each download via Promise-based polling
- Add ARIA labels on interactive elements
- Improve title sanitization (80 char limit)
- reclip.sh: always run pip install on venv reuse
- reclip.sh: add EXIT trap for clean shutdown message

Author: DeBondor

.gitignore

@@ -3,8 +3,9 @@ downloads/
 __pycache__/
 *.pyc
 assets/*.mov
+assets/*.mp4
+assets/*.mkv
+assets/*.webm
 .DS_Store
 .env
-.env.local
-.env.production
-.env.development
+.vscode/

Dockerfile

@@ -4,11 +4,16 @@ RUN apt-get update && \
     apt-get install -y --no-install-recommends ffmpeg && \
     rm -rf /var/lib/apt/lists/*
 
+# Run as non-root user
+RUN useradd --create-home --shell /bin/bash reclip
 WORKDIR /app
 COPY requirements.txt .
 RUN pip install --no-cache-dir -r requirements.txt
 
 COPY . .
+RUN mkdir -p downloads && chown -R reclip:reclip /app
+
+USER reclip
 
 EXPOSE 8899
 ENV HOST=0.0.0.0