feat: Expose filename-override operations as obs-websocket vendor requests

[hanatyan128]

Summary

• Register osi_branch_output obs-websocket vendor with three requests that mirror the existing proc handler APIs: get_filter_list, override_recording_filename_format, override_replay_buffer_filename_format.
• Allow external tools, bots, and Stream Deck plugins to drive filename overrides over obs-websocket without running an in-process OBS script.
• Add lib/obs-websocket as a tag-pinned git submodule (5.7.3) for the vendor API headers only; no runtime linkage.
• Document the vendor API in API.md / API_ja.md with the same audience as the existing proc handler reference; README.md / README_ja.md now point there.

Vendor requests

Request	Request data	Response
get_filter_list	(none)	{ success, error?, filters: array }
override_recording_filename_format	{ filter_uuid, format }	{ success, error? }
override_replay_buffer_filename_format	{ filter_uuid, format }	{ success, error? }

• filters elements expose source_name, source_uuid, filter_name, filter_uuid, matching the existing osi_branch_output_get_filter_list proc handler.
• Passing an empty format clears the override (same semantics as the proc handlers).

Input validation

• filter_uuid must be a 36-character hyphenated UUID. Non-matching shapes return "filter_uuid must be a UUID string".
• format is capped at 1024 bytes (strnlen early-exit). Oversized inputs return "format too long".
• The resolved source must be a Branch Output filter (osi_branch_output). Non-matching sources and missing UUIDs both return "Filter not found" to avoid leaking existence information.
• obs_source_get_id() null-guard added for defensive safety on the ws worker thread path.

Security model

• Vendor requests are accepted only from clients authenticated with obs-websocket.
• obs-websocket auth is a single shared password with no per-vendor capability model, so any authenticated client has full access equivalent to the OBS user. The format string is forwarded to libobs's filename expander unchanged and can therefore include subdirectory paths or overwrite existing recordings.
• API.md / API_ja.md capture this explicitly in the Security section.

Build / CI

• CMakeLists.txt: FATAL_ERROR guard if the submodule is missing; CMAKE_CURRENT_SOURCE_DIR used for super-build robustness.
• .gitmodules: tag-pinned operation documented via comment (no branch = entry so --remote cannot drift).
• build-aux/.run-format.zsh: exclude lib/* so local cmake-format runs do not pick up submodule files.
• .gitignore: allowlist !/lib to un-ignore the submodule directory.
• .github/workflows/check-format.yaml: unchanged (submodule checkout not required; format scope is src/ and project CMake files).

Threading / lifecycle caveats

• Vendor callbacks run on obs-websocket worker threads and block on outputMutex via the underlying proc handlers. A recording transition (split/restart) can pin the caller for up to ~1 s. Documented inline as a FIXME for future rework (in-flight counter + timeout).
• obs_websocket_vendor_unregister_request() does not wait for in-flight callbacks; documented as a FIXME parallel to the existing statusDock shutdown race.

Test plan

• Load the plugin with obs-websocket installed; confirm the vendor and three requests are registered (check OBS log).
• Load the plugin without obs-websocket installed; confirm a warning is logged and the plugin still loads.
• Call get_filter_list via an obs-websocket client; confirm filters lists every Branch Output filter with correct source_* / filter_* fields.
• Call override_recording_filename_format with a valid filter UUID and observe the next recording uses the new format; pass "" to clear.
• Call override_replay_buffer_filename_format with a valid filter UUID and confirm the next replay save uses the new format; pass "" to clear.
• Send malformed input (short UUID, 2 MB format, non-filter source UUID); confirm each returns the expected success=false + error message.
• Build on Windows / macOS / Linux with the submodule initialized.
• Run cmake --fresh without the submodule and confirm the FATAL_ERROR message instructs git submodule update --init --recursive.
• Run ./build-aux/run-cmake-format --check locally with the submodule present; confirm no submodule files are scanned.

🤖 Generated with Claude Code