[thorwhalen]

Closes #44 (the yb side; braidio/reelee/muvid callers are follow-ups in their repos).

yb.download.download_audio_bounded(url, *, download_dir, max_bytes=80MiB, max_duration_s=45min, validate_target=require_http_url, extra_opts=None, cookies_file=None, notice=COPYRIGHT_NOTICE) -> AudioDownload(path, title, duration_s, notice, info).

Policy once: target check before any network (also on the resolved page URL); metadata preview refuses playlists, live streams and over-long sources before any media bytes; caps pinned (max_filesize, noplaylist, playlist_items=1, match_filter duration/live, mp3 extractor); extra_opts restricted to an allowlist DEPLOYMENT_OPT_KEYS (cookies, headers, proxy, credentials, extractor args), anything else raises, so no option can widen a cap or redirect output; extracted-size check; each call writes into its own private directory (no collisions), removed on any failure; AudioLimitError for refusals.

Adversarial review (Opus, two rounds). Round 1 found: playlist URL bypassing both caps, live/unknown-duration unbounded, "can't widen" only true for two keys, files left on failure, default byte cap below the duration cap's mp3 size, resolved URL not validated. All fixed (allowlist, pinned opts, preview refusal, temp dir, 80 MiB default, tests on the real options). Round 2 found a blocker my fakes could not see: max_downloads=1 makes yt-dlp raise after the first success; removed, and a test now runs real yt-dlp + ffmpeg against a local HTTP file (skipped without ffmpeg). Also fixed: silent overwrite on same-video calls (per-call dir), misleading ffmpeg-failure message. Left as documented limits: validate_target is not an egress sandbox (yt-dlp follows redirects); unknown duration is bounded by bytes only. yt-dlp added to the dev extra so the option tests run.

Verified live here: duration cap against real YouTube metadata; the media fetch from this server's IP is 403-gated (cookies seam), so end-to-end is covered by the local-server test.

Mapping for braidio: keeps creds.check() and error mapping, passes creds.opts as extra_opts (must be within the allowlist) and its SSRF check as validate_target, ingests result.path then removes path.parent.