fix(youtube): validate OAuth state parameter during authentication

Add a check that the `state` returned in the OAuth callback matches the value stored before the sign-in flow began. This prevents CSRF attacks by ensuring the response corresponds to the original request. If the state does not match, an error is thrown with a clear message prompting the user to re-authenticate.

[auto-enhanced]

Author: steveseguin

sources/websocket/youtube_auth.js

@@ -202,6 +202,10 @@
 		if (!result || !result.code) {
 			throw new Error("YouTube sign-in did not return an authorization code.");
 		}
+		var expectedState = getStoredState();
+		if (!expectedState || result.state !== expectedState) {
+			throw new Error("State mismatch during YouTube sign-in. Please try signing in again.");
+		}
 		var data = await postHostedYouTubeAuthJson("/token", {
 			code: result.code,
 			redirect_uri: result.redirectUri,