YouTube URL detection matches domains by substring

[anirudh5harma]

Summary

The web app detects YouTube URLs by searching for youtube.com or youtu.be anywhere in the URL string instead of parsing the hostname. This produces false positives for lookalike domains and paths.

Reproduction

Current helpers and render paths use substring checks, for example:

isYouTubeUrl("https://notyoutube.com/watch?v=dQw4w9WgXcQ") // true, but should be false
isYouTubeUrl("https://evil.example/youtube.com/watch?v=dQw4w9WgXcQ") // true, but should be false
isYouTubeUrl("https://youtube.com.evil.example/watch?v=dQw4w9WgXcQ") // true, but should be false

Concrete current impact exists in several web UI paths:

• apps/web/components/document-modal/content/index.tsx classifies any document URL containing youtube.com as youtube before the webpage fallback.
• apps/web/components/utils.ts exposes isYouTubeUrl() with substring matching, used by memory card previews.
• apps/web/components/document-icon.tsx can show the YouTube icon for non-YouTube hosts.

Expected behavior

YouTube detection should parse the input as a URL and match only real YouTube hostnames:

• youtube.com and its real subdomains, including www.youtube.com and m.youtube.com
• youtu.be and its real subdomains if needed
• paths or unrelated hosts that merely contain those strings should not match

The parser should also preserve behavior for uppercase URL schemes such as HTTPS://youtube.com/watch?v=....

Suggested fix

Centralize YouTube URL parsing in the existing web helper, compare hostnames instead of substrings, and make the document modal/icon paths consume that helper. Add regression tests through the exported helper for lookalike domains, path-only matches, short links, mobile links, and uppercase schemes.

[linear-code]

ENG-928

[abhay-codes07]

Opened #1182 for this - moved the check into lib/url-helpers.ts next to isTwitterUrl so both use the same hostname matching, and pointed the modal/icon/timeline paths at it. Added regression tests for the lookalike and path-only cases from the report.