Explain the YouTube API key and refuse OAuth values in its field - #1608

Summary

7 of the 8 YouTube Data setups in the first week of November stopped at Google's "API key not valid". The field had no help text or format check. The usual mix-up on the Credentials page is pasting the OAuth client ID or client secret instead of the API key.

Changes

• youtube-data.json: envVarMeta for YOUTUBE_API_KEY with a label, help (where to create it, "starts with AIza, 39 characters", not the OAuth client ID / secret), a link to the Credentials page, and a pattern that refuses an OAuth client ID, a client secret (GOCSPX-), an access token (ya29.) and values with spaces. The pattern does not require the AIza prefix, so a key in a future Google format is not blocked.
• The 400 hint says what a key looks like.
• Static spec for the pattern.

Same in Cloud and self-hosted.

Type

• Bug fix

Testing

• Added/updated unit tests

node scripts/regenerate-catalog.mjs          # 731 adapters
node scripts/validate-adapters.mjs --warn    # no new warnings
cd packages/backend && npx jest --maxWorkers=4 src/adapters   # 722 suites passed, 1 skipped

Checklist

• My code follows the existing code style
• I have tested my changes locally
• All existing tests pass
• This PR has a descriptive title