Pluggable AI providers, relay credit system, picker UX overhaul

Captures roughly forty version bumps (v0.2.6 → v0.2.47) of work that
accumulated without commits.

- Pluggable provider system under server/providers/: gemini, anthropic,
  openai, openai-compatible, ollama, whisper-compatible, relay. Mix and
  match transcription + analysis per request via the picker UI.
- Relay backend integration. Hardcoded relay URL in server/relay-default.js
  (operator-controlled at build time, not user-configurable). New
  /api/relay/{status,policy} endpoints proxy to the relay; balance pings
  populate a cached credit display.
- Per-install identity in server/install-id.js for relay credit accounting.
  Sent to the relay as X-Recap-Install-Id; persists across upgrades, lost
  on a full uninstall + reinstall. Not surfaced in the UI.
- Admin login gate (server/admin-auth.js + setAdminPassword action). Scrypt
  password hash + HMAC-signed session cookie.
- Entitlement scheme rename: pro / max (each paired with subscriptions and
  relay_pro / relay_max), replacing the misleading "core" entitlement
  that conflicted with the user-facing "Core" tier name.
- Activation screen: dynamic credit count pulled from /api/relay/policy,
  "Skip — use free mode" button, accurate paid-feature list.
- Top toolbar: inline credit-balance pill (or "BYO configured" fallback),
  Upgrade + "I have a key" buttons.
- Picker UI: per-provider sections with Save/Test/Delete buttons, sections
  collapsible by chevron, default-collapsed unless currently selected,
  "Use comped credits (reset to relay)" link when the user has strayed,
  green hint under inputs whose values are server-configured.
- Activity log: chevron-collapsible groups per video, refresh-survival via
  localStorage + a 500-entry server-side buffer, explicit Clear button.
- YouTube captions fast-path with user toggle (skips audio download + AI
  transcription when captions are available — uncheck for speaker labels).
- Cancel button: AbortController plumbed through every provider SDK call;
  retryAPI short-circuits on AbortError; cancellation events surface in
  the activity log instead of silent retries.
- Long-video analysis: auto-coalesce transcript entries before building the
  analysis prompt so local-model context windows (32k-ish) don't overflow.
  Original entries preserved for transcript display via an index map; the
  analyzer sees a coarser view but click-to-seek timestamps stay precise.
- StartOS action grouping (Setup / AI Providers) so the actions list is
  navigable.
- Manifest description rewritten to reflect multi-provider support and
  free-tier relay credits.
- Smaller fixes: summarize-button enablement no longer requires a Gemini
  key when other providers are configured; analysis fallback chain handles
  context-length and 503 capacity errors; single-segment expansion for
  providers that don't return per-segment timestamps (Parakeet et al.);
  many other UX polish items.

server/license.js

@@ -10,17 +10,26 @@
 //   PRODUCT_SLUG    → must match the product slug created in Keysat
 //   KEYSAT_BASE_URL → optional, only used by online validate() / purchase
 //
-// Tier model for this app (see KEYSAT_INTEGRATION.md §0):
-//   "core"           — required for any business endpoint; unlocks
-//                      summarization and BYO Gemini API key
-//   "history"        — saved summary library: /api/history*
-//   "library"        — bulk import/export: /api/library/*
-//   "subscriptions"  — Pro: channel subs, auto-queue, sub-check log
-//   "clips"          — Pro: paperclip / clip-collection panel
+// Tier model for this app:
+//   Core / Free       — no license. Library + history + lifetime relay
+//                       credits (count set by recap-relay's Adjust Tier
+//                       Quotas action; default 10). BYO API keys or
+//                       self-hosted model URL gives unlimited use.
+//   Pro               — license with entitlements:
+//     "pro"           — flags the license as paid; unlocks the
+//                       activation gate
+//     "subscriptions" — channel + podcast subs, auto-queue, sub-check log
+//     "relay_pro"     — recap-relay reads this and applies the Pro
+//                       monthly cap (defaults: 50/mo, 25 Gemini-served)
+//   Max               — license with entitlements:
+//     "max"           — same gate as "pro" (server treats either as paid)
+//     "subscriptions" — same feature set as Pro
+//     "relay_max"     — recap-relay applies the Max monthly cap (default
+//                       unlimited, with 50/month Gemini sub-cap)
 //
-// Tier policies:
-//   Core → ["core", "history", "library"]
-//   Pro  → ["core", "history", "library", "subscriptions", "clips"]
+// Older entitlements ("core", "library", "history", "clips") were used
+// in pre-1.0 builds. They are unused by the current server; harmless to
+// ship in legacy keys.
 
 import fs from "fs";
 import path from "path";
@@ -83,6 +92,15 @@ function getOnlineClient() {
 //   1. RECAP_LICENSE_KEY env var (overrides everything; useful for tests)
 //   2. license.txt at LICENSE_PATH (web-UI activation writes here)
 //   3. recap_license_key in startos-config.json ("Set Recap License" action)
+// Read-only accessor for the raw license key (LIC1-...). Returns null
+// when no license is configured. Used by the relay provider when
+// attaching the Authorization header so the relay can do its cached
+// online check against keysat. Don't add this to publicView — it's
+// server-side only and should never reach the browser.
+export function getRawLicenseKey() {
+  return readLicenseString();
+}
+
 function readLicenseString() {
   const fromEnv = (process.env.RECAP_LICENSE_KEY || "").trim();
   if (fromEnv) return fromEnv;