Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

The project had no test infrastructure. Add jest with ts-jest, @nestjs/testing
and supertest, covering the livestream feature: the service state machine
(status transitions, adaptive poll cadence, quota batching, feed and API
failures), the config parser's validation matrix, the controller, and the HTTP
surface end to end.

The e2e suite also guards the RSS-only decision, so it cannot silently revert:
/pubsub must stay a 404 and nothing may call pubsubhubbub.appspot.com.

tsconfig.build.json keeps spec files out of dist, which nest build would
otherwise compile and ship in the container image. pnpm-workspace.yaml
acknowledges unrs-resolver's build script, a transitive jest-resolve
dependency; its prebuilt binary arrives as an optional dependency, so the
script is skipped as @nestjs/core's is. CI runs both suites on Node 24 with the
release-age cooldown disabled for the frozen install, for the same reason the
container build disables it.

Restructure the repo around the conventions in
https://standards.openhomefoundation.org/ so it looks and behaves like the
foundation's other projects.

Tasks and scripts:
- Add script/ (setup, update, server, test, cibuild) following
  scripts-to-rule-them-all, so contributors and CI run the same code paths.
- Add .mise.toml registering the standard lifecycle tasks (setup, update, dev,
  test, ci) that delegate to script/, plus convenience tasks for lint, format,
  typecheck, build and a REPL.
- Provision the toolchain in the devcontainer via mise (script/install-mise)
  instead of duplicating setup steps in .devcontainer.json.
- Have CI and the release workflow call script/cibuild rather than restating
  the pipeline.

Code style and hygiene:
- Add Prettier and a flat ESLint config, format the tree, and enforce both in
  a husky pre-commit hook via lint-staged.
- Pin the toolchain: packageManager, Node 24 in mise/CI/Dockerfile.
- Harden installs in pnpm-workspace.yaml: minimumReleaseAge of 7 days against
  freshly published malicious releases, and explicit allowBuilds decisions for
  the three dependencies with postinstall scripts.
- Rename .env.example to example.env and document configuration in README.md.
- Ignore the project-local .pnpm-store the devcontainer creates.

API documentation:
- Serve an OpenAPI document and Swagger UI at /docs (JSON at /docs-json),
  versioned from the running build, and annotate the livestream and health
  responses so the spec is generated from the code.
- Cover the served spec with test/swagger.e2e-spec.ts.

Clears the 23 no-explicit-any warnings, so lint is silent, and restores the
rule to the recommended 'error' now that nothing needs the exemption.

- Model the YouTube Data API surface we actually read as YouTubeItem and
  YouTubeListResponse, and use them for track(), videoDetails() and apiGet().
  Only the fields we request a `part` for are declared, all optional bar `id`,
  and apiGet asserts the parsed body rather than pretending it is validated.
- Reading a real type surfaced two spots the compiler could not check before:
  a channelId lookup that could be passed undefined, and a past-window check
  that reached for actualEndTime through a separate status variable. Both now
  narrow explicitly; behaviour is unchanged in each case.
- Type the health module's async params from Nest's own FactoryProvider rather
  than restating its variadic factory signature, so the two cannot disagree,
  and report health payloads as Record<string, unknown>.
- In the e2e specs, type the supertest target as node:http Server and the
  response entries as LivestreamInfo, which makes each assertion state the
  contract it is checking.

Adds helmet as setupSecurity() in main.ts, applied before Swagger mounts its
routes: Express walks middleware and handlers in registration order, so a route
registered first would answer without the headers.

Helmet's defaults are taken unchanged. The one thing that usually forces a
custom policy is the Swagger UI, and it does not here: every script that page
loads is external and same-origin, which `script-src 'self'` allows, and its
inline <style> blocks are covered by a default `style-src` that includes
'unsafe-inline'.

test/security.e2e-spec.ts pins both halves of that. It asserts the headers on a
JSON collection, a health probe, the OpenAPI document, the UI and a 404, and it
checks the served UI against the policy protecting it — no inline script, no
inline event handler, no off-origin script source. A Swagger release that starts
inlining its init script therefore fails a test rather than silently breaking
the page in browsers.

Verified the suite fails without the middleware before keeping it.

The sites that consume this API are deployed independently of it, so who may
call it belongs in configuration: CORS_ORIGINS takes a comma-separated list of
origins, or "*" for any.

Entries are normalised to what a browser actually sends in Origin — scheme,
host, non-default port, lowercased — so a trailing slash or odd casing in the
environment still matches. Anything that could never match is rejected at
startup instead: a bare hostname, a non-http scheme, a path, query, fragment or
credentials, an embedded wildcard, "*" mixed with named origins, and the same
origin listed twice. That follows LIVESTREAM_CHANNELS' precedent — a typo here
would otherwise surface only as a CORS error in someone else's browser console.

Unset means no cross-origin headers at all, with a warning logged at startup.
The API still answers every request; a browser simply will not hand the body to
a page on another site. A deployment that has not said who may read it should
not have that guessed at, and "*" is one character away for anyone who wants it.

Only GET is advertised, since every endpoint here is a read.

Covered by unit specs over the parser and an e2e suite over the served headers:
an allowed origin, a second allowed origin, an unconfigured one, a preflight,
"*", and nothing configured. A third suite needing the same boot made the
harness worth extracting, so swagger and security now share
test/test-app.fixture.ts, which assembles the app exactly as bootstrap() does.

Also verified against a real `node dist/main`: the header is echoed for the
configured origin, Vary: Origin is set, and other origins get nothing.

It pinned debug.javascript.defaultRuntimeExecutable to a path under one
developer's home directory, which does not exist for other contributors or in
the devcontainer. Shared editor configuration belongs in .devcontainer.json,
which already sets the formatter and the required extensions.

The foundation's sites are spread across subdomains — www, developers, data —
and enumerating them in CORS_ORIGINS would mean a deploy every time one appears.
An entry may now name a domain's subdomains instead: https://*.esphome.io.

Matching is an anchored pattern per entry, so it stays narrow. It covers any
depth of subdomain (www.esphome.io, a.b.esphome.io) but not the bare domain —
list that separately when it also serves pages — and a literal dot before the
domain keeps a lookalike like evil-esphome.io out, as the anchor keeps out
esphome.io.evil.example. Scheme and port must still match exactly.

A wildcard anywhere other than the leading label is rejected, as is one covering
a whole suffix ("*.io"), since that would hand every .io site access. "*" alone
still means any origin, and still cannot be mixed with named entries.