Add YouTube upload pipeline (tools/youtube_upload.py + /publish)

[dascope]

What

Adds the toolkit's first publishing capability: upload a rendered video to YouTube via the Data API v3, with a guided /publish workflow that fills metadata from a project's project.json.

New

• tools/youtube_upload.py — OAuth 2.0 installed-app flow with silent token refresh (per-account cache), resumable upload with exponential-backoff retry, optional thumbnail/captions/playlist, and private/unlisted/public or scheduled (publishAt) visibility. Flags include --auth, --dry-run, --json-out, --account.
• /publish command (.claude/commands/publish.md) — locates a project's render, drafts title/description/tags, dry-runs, uploads, and writes the resulting video URL back to project.json.
• docs/youtube-upload.md — Google Cloud Console walkthrough, quota math, and the relevant gotchas.

Changed

• tools/config.py: get_youtube_client_secrets_file(), get_youtube_token_dir().
• tools/requirements.txt: google-api-python-client, google-auth-oauthlib, google-auth-httplib2.
• Registry entries (tools.youtube_upload, commands.publish), CLAUDE.md publishing section, .env.example.
• .gitignore: ignores the _internal/.youtube/ OAuth token cache (refresh tokens are secrets).

Auth model

Uploads act on behalf of a channel, so this uses OAuth 2.0 (Desktop-app client), not an API key. First run does a browser consent (--auth); the refresh token is cached and reused silently afterward.

Testing

Live-tested end-to-end against a real channel:

• --help, --dry-run, and registry JSON parse — verified.
• Real uploads of a 60s render: requested unlisted → stayed unlisted; requested public → processed and stayed public (no rejection). Test videos deleted afterward.
• Note on the docs' "unaudited projects are restricted to private" rule: in practice it targets third-party apps uploading to other channels — first-party uploads (own Cloud project + own channel + own account) publish public/scheduled fine without an audit. The tool reports the actual returned privacyStatus as the source of truth.

Notes for maintainers

• All google-* deps are optional and only imported by this tool (graceful ImportError hint if missing).
• No secrets in the diff; the token cache and client secret live under the gitignored _internal/.youtube/.

🤖 Generated with Claude Code