fix(auth): refresh the access token instead of caching it once

[emrementese]

Problem

auth() returned a bare String and dropped the Authenticator, so the process ran on a single access token for its entire lifetime. Google's access tokens expire after roughly an hour — well inside a normal broadcast.

After that hour, every request fails with UNAUTHENTICATED, the reconnect loop burns its five attempts in seconds, and live chat is dead for the rest of the stream. The refresh token was sitting on disk the whole time, unusable because the authenticator that owns it was gone.

This is the single most likely cause of "chat keeps dropping mid-broadcast": it works at first, then dies and never comes back.

Fix

Keep the Authenticator in YoutubeService and ask it for a token before each request. yup-oauth2 serves the cached token and refreshes it transparently near expiry.

Also in here

Three closely related fixes in the same code:

• The OAuth token was being sent to third-party hosts. The reqwest::Client carried Authorization: Bearer <token> as a default header, and the same client fetches profileImageUrl values taken straight from API responses — so the user's token went to whatever avatar host the payload named. The default header is gone; auth is attached per-request, to googleapis.com calls only.
• The HTTP client had no timeouts at all, so a hung request could stall indefinitely. Added request and connect timeouts, plus a real user agent.
• Two panics in auth() (install_default().unwrap() and panic!("Couldn't get oauth token")) are now ordinary errors. Credential files are created 0600, the app directory 0700.

Verification

cargo build / cargo test clean. The refresh path itself needs a >1h live session to exercise end to end; I have not been able to run that.

---

First of a 7-PR series splitting up a set of live-chat reliability fixes. Nothing depends on this one, but the rest build on it.

🤖 Generated with Claude Code

[emrementese]

Claude ile repodaki temel problemleri çözdüren bir Pr serisinin ilk aşamasıdır. Pr'lar bir birine bağımlı olduğu için conflict çıkmaması adına reviewlendikten ve test edildikten sonra sırayla merge edilmeli. bunun dısında test için bir CI da yazdirdim. İyi calismalar