feat(channel): page details chaine multi-providers avec onglets et infinite scroll

- Strategy Pattern front: ChannelProviderInterface + 6 providers (yt/dm/tw/pt/od/ru) + factory (ids longs/courts)
- ChannelContentService: cache par onglet/tri/recherche (TTL 5min), pagination nextPage
- ChannelPage: header (banniere/avatar/subs/description ...plus), tabs dynamiques par capabilities, grilles videos/shorts 9:16/playlists/live, recherche debounced, tri recent/populaire, infinite scroll IntersectionObserver, skeletons/empty/error
- Backend: GET /api/channels/:provider/:id/content (videos/shorts/playlists/live) natif par provider

assets/config.local.example.js

@@ -1,25 +1,24 @@
-// Local (non-versioned) config for API keys and secrets.
+// Local (non-versioned) config for API keys.
 // Copy this file to `assets/config.local.js` and fill in your keys.
 // IMPORTANT: Restrict keys in their provider consoles (HTTP referrers, APIs enabled).
+//
+// SECURITY NOTE: everything set here is shipped to the browser. Only put
+// browser-safe, referrer-restricted keys in this file. Server-only secrets
+// (TWITCH_CLIENT_SECRET, GEMINI_API_KEY, JWT_SECRET...) must be provided via
+// environment variables on the backend instead — the app consumes them through
+// /api/twitch-token and /api/ai/* endpoints.
 
 // YouTube Data API v3 key (browser-safe only if properly restricted by HTTP referrer)
-window.YOUTUBE_API_KEY = 'AIzaSyCumEzXNPJuQjpPpxhP2PYdExqRBDVJqRY';
+window.YOUTUBE_API_KEY = 'PUT_YOUR_YOUTUBE_API_KEY_HERE';
 
-// Optional: Gemini (for comment summarization)
-// window.GEMINI_API_KEY = 'PUT_YOUR_GEMINI_API_KEY_HERE';
+// Optional: you can also provide multiple keys (CSV) via server env YOUTUBE_API_KEYS.
 
-// Vimeo API Access Token (must have 'public' scope)
-window.VIMEO_ACCESS_TOKEN = 'PUT_YOUR_VIMEO_ACCESS_TOKEN_HERE';
-
-// Twitch API Credentials
-window.TWITCH_CLIENT_ID = 'PUT_YOUR_TWITCH_CLIENT_ID_HERE';
-window.TWITCH_CLIENT_SECRET = 'PUT_YOUR_TWITCH_CLIENT_SECRET_HERE';
-
-// Rumble API key (required for Rumble integration in this app)
-// Some Rumble endpoints are not public. This app expects a key surfaced as window.RUMBLE_API_KEY.
-// If you don't have one, select another provider in the header.
-window.RUMBLE_API_KEY = 'PUT_YOUR_RUMBLE_API_KEY_HERE';
+// Rumble API key (optional — Rumble now works via server-side scraping)
+// window.RUMBLE_API_KEY = 'PUT_YOUR_RUMBLE_API_KEY_HERE';
 
 // Odysee: no API key is required when using the built-in proxy.
 
-// You can add other provider keys/tokens here if needed in the future.
+// Twitch: configured via server env (TWITCH_CLIENT_ID / TWITCH_CLIENT_SECRET).
+// Gemini: configured via server env (GEMINI_API_KEY).
+
+// You can add other browser-safe provider keys/tokens here if needed in the future.