M1 sidecar — resolve (rustypipe + yt-dlp), rip, sponsorblock

JSON-over-stdio loop on tokio with four ops:
- ping              liveness
- resolve           Tier 1 rustypipe → Tier 2 yt-dlp -j fallback. Typed
                    errors (age/region/private/not-found) short-circuit
                    Tier 2 so we don't double-hit a wall. Pass-through
                    serialization of player.details + selected streams,
                    so the Python addon parses what it needs without us
                    coupling to rustypipe's struct shape.
- rip               Tier 3 yt-dlp downloads bestvideo+bestaudio to a
                    caller-supplied dest_dir, returns the resulting
                    path + size for the addon to play as a local file.
- sponsorblock      SHA-256 prefix lookup (first 4 hex), filter to the
                    exact video_id locally. Categories default to
                    [sponsor, selfpromo, interaction]; caller can override.

Smoke ran in the build container against dQw4w9WgXcQ — rustypipe 0.11.4
still resolves cleanly in 2026-05, sig decoding intact, both 4K AV1
video and Opus 128kbps audio came back with valid signed URLs.
SponsorBlock returns empty segments for music videos (as expected).

sidecar/crates/torttube-sidecar/Cargo.toml

@@ -11,4 +11,23 @@ name = "torttube-sidecar"
 path = "src/main.rs"
 
 [dependencies]
-# M1 — rustypipe (codeberg.org/ThetaDev/rustypipe), tokio, serde, serde_json, reqwest
+# Tier 1 — native Rust Innertube
+rustypipe = "0.11"
+
+# Tier 2 + 3 — yt-dlp subprocess shell-out (no library, just std::process)
+
+# Runtime + JSON-over-stdio
+tokio = { version = "1", features = ["rt-multi-thread", "macros", "io-std", "io-util", "process", "fs"] }
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+
+# Errors + logging
+anyhow = "1"
+thiserror = "1"
+tracing = "0.1"
+tracing-subscriber = { version = "0.3", features = ["env-filter"] }
+
+# SponsorBlock — sha256 + REST
+sha2 = "0.10"
+hex = "0.4"
+reqwest = { version = "0.12", default-features = false, features = ["rustls-tls", "json"] }