feat: YouTube preview streaming and improved search result cards

[safepay]

Summary

YouTube iframe embeds fail when video owners disable embedding, corporate/school firewalls block YouTube embed domains, or privacy filters block iframes. Users can't preview videos before downloading, leading to wasted downloads and poor UX (#650).

This uses the same yt-dlp binary that already powers search and download — just an additional -g flag to resolve a direct stream URL. If it fails, the modal closes gracefully; no existing functionality is affected.

Changes:

• yt-dlp stream preview: click a thumbnail to stream a low-quality preview via HTML5 <video> instead of iframe embed, bypassing all embed restrictions
• Richer search results: channel name, duration badge (M:SS), and direct YouTube link extracted from existing yt-dlp JSON output (no extra subprocess calls)
• Consistent thumbnail layout: switched from 4:3 0.jpg (letterboxed) to 16:9 mqdefault.jpg; replaced Bulma column grid with clean flexbox (200px fixed on desktop, full-width stacked on mobile)

Fixes #650

Test plan

• Pre-commit checks pass
• All 520 tests pass
• Search results show channel, duration, and YouTube link
• Click thumbnail opens video preview modal (including videos that block iframe embeds)
• Desktop: consistent thumbnail sizes, duration badge bottom-right, download button aligned right
• Mobile: thumbnails full-width, title + button stacked below