fix: restore security hardening compatibility and validation

Restore authorized rule reveal, explicit full HTTP capture and retention, video task business fields, and valid payment URLs. Add opt-in credential preservation for trusted recovery, fix frontend type contracts and async races, and eliminate PostgreSQL test fixture resource leaks. Document audit coverage and successful fmt and CI-scoped Clippy checks.

crates/aether-video-tasks-core/src/transport.rs

@@ -1,4 +1,4 @@
-use serde_json::Value;
+use serde_json::{json, Value};
 
 use crate::LocalVideoTaskStatus;
 
@@ -20,9 +20,12 @@ pub fn parse_video_content_variant(query_string: Option<&str>) -> Option<&'stati
 }
 
 pub fn gemini_metadata_video_url(metadata: &Value) -> Option<String> {
-    metadata
-        .get("response")
-        .and_then(|value| value.get("generateVideoResponse"))
+    metadata.get("response").and_then(gemini_response_video_url)
+}
+
+pub(crate) fn gemini_response_video_url(response: &Value) -> Option<String> {
+    response
+        .get("generateVideoResponse")
         .and_then(|value| value.get("generatedSamples"))
         .and_then(Value::as_array)
         .and_then(|value| value.first())
@@ -32,6 +35,19 @@ pub fn gemini_metadata_video_url(metadata: &Value) -> Option<String> {
         .map(str::to_string)
 }
 
+pub(crate) fn gemini_video_metadata(video_url: Option<&str>) -> Value {
+    match video_url {
+        Some(video_url) => json!({
+            "response": {
+                "generateVideoResponse": {
+                    "generatedSamples": [{"video": {"uri": video_url}}]
+                }
+            }
+        }),
+        None => json!({}),
+    }
+}
+
 pub fn map_openai_task_status(status: LocalVideoTaskStatus) -> &'static str {
     match status {
         LocalVideoTaskStatus::Submitted | LocalVideoTaskStatus::Queued => "queued",