Fix YouTube search failures and audit plugin safety

[variablenix]

Summary

• Preserve API and public-page YouTube searches; support current renderers and recover with validated indexed video links when YouTube returns an age/consent page. Viewing restrictions are not bypassed.
• Keep full-query priority with explicit title-only recovery for artist - title searches that have no indexed match. Bound fallback time and UTF-8/IRC replies while retaining video links.
• Fix audit findings: private/cross-network/channel seen history, CVE/package alias routing, IP cancellation deadlock, weather body leaks, corrupt poll votes, and reminder persistence failures.
• Keep authenticated API redirects on their original origin, enforce safe IRC output centrally, and document significant changes.

Compatibility call-out

Seen history is now channel-scoped. Private-message lookups cannot disclose channel history. Legacy unscoped records remain stored but are not exposed; fresh channel messages create safely scoped records.

Validation

• Fresh race-test suite, go vet, staticcheck, build, and govulncheck passed; no known dependency vulnerabilities reported.
• All 69 plugins initialized and passed command-boundary checks (342 aliases).
• Deployment-host live checks passed for 20 command handlers, both reported YouTube formats, ordinary video searches, define, and Search Assist examples.
• Verify, Analyze Go, and CodeQL passed on the final head; no open CodeQL alerts for this PR.
• Supplemental gosec warnings were reviewed: gameplay randomness, operator-controlled local files/TLS opt-out, legacy checksum utilities, and best-effort close/write handling are not new credential/authentication defects. Raw scanner logs are not published.

Tests establish the checks above, not a guarantee of third-party uptime or the absence of all defects.

[variablenix]

Deployment verification completed: the merged main revision was rebuilt and the service restarted using the operator workflow. Configuration was preserved. Both IRC networks and all configured channels are connected. Both reported YouTube query formats passed three consecutive post-deployment runs. The deployment-host full race-test suite and representative provider checks passed. Temporary audit checkouts and deployment snapshots were removed after verification.