fix: stabilize desktop YouTube import fallback

[seonghobae]

Summary

• Fix browser/dev YouTube imports so they do not call Tauri invoke when no usable native bridge exists.
• Return a valid local project bootstrap from the browser fallback and keep the fallback URL allowlist aligned with native YouTube validation.
• Carry forward the post-merge UI copy polish that removes generic app/bootstrap wording from the release branch.

Verification

• npx vitest run src/lib/analysis.test.ts (red first: 2 failing fallback tests, then 4 passing)
• npm run test in apps/desktop (40 passed, 100% covered files)
• npm run lint in apps/desktop
• npm run typecheck in apps/desktop
• npm run build in apps/desktop
• npm audit --workspaces --audit-level=high (0 vulnerabilities)
• ./scripts/harness/quickcheck.sh (passed on clean PR branch)
• Playwright localhost flow: filled YouTube URL, clicked 유튜브 가져오기, saw youtube-preview.m4a, clicked 분석 시작, saw 구간 흐름; no new console errors from the import/start flow.

Security Notes

• YouTube URLs remain untrusted input. The browser fallback now accepts only HTTPS youtube.com/subdomain /watch?v=... URLs or single-segment youtu.be URLs, matching the native command allowlist.
• The fix does not add network fetching in the browser fallback; it only creates a local dev/test bootstrap summary.
• Tauri IPC remains allowlisted by command name, and browser/dev mode only uses native invoke when the Tauri v2 bridge exposes a callable invoke function or the existing legacy shim is present.
• No full URLs, tokens, cookies, local paths, or remote metadata are logged by this change.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: a62f1a2f-ef45-48d2-b4c2-6be61720e2df

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/youtube-import-browser-main

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}