Add thumbnail, metadata, and YouTube publishing handlers (#40, #41, #42)

ThumbnailGenerationHandler (#40): generates thumbnail candidates via
StabilityAI, one per style (default: two contrasting styles) — all
stored as assets on the same step, so the existing approval UI's
"show every asset on this step side by side" behavior is the A/B
comparison the task calls for, no extra UI needed.

MetadataGenerationHandler (#41): SEO title/description/tags/hashtags
from the project's script via OpenAI in JSON mode, same pattern as
StoryboardHandler.

YoutubePublishHandler (#42): real OAuth2 + YouTube Data API v3
resumable upload (token refresh -> init session -> PUT video bytes),
supporting scheduling via publishAt (forces privacyStatus=private per
YouTube's own constraint). Reuses the AiProvider table for credentials
(provider='youtube', api_key=refresh_token, config=client_id/secret)
rather than a new table — added 'youtube' to AiProvider::PROVIDERS.
Does not cover analytics retrieval: that's an ongoing query against a
published video, not a one-shot publish action, so it doesn't fit the
per-video step model at all.

All 8 WorkflowStep::TYPES now have real handlers, so the "unhandled
type" test fixtures (which used real-but-not-yet-implemented types)
would go stale every time a new module lands — switched them to
fabricated type strings so they stay meaningful regardless of what
gets built next.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

app/Models/AiProvider.php

@@ -9,7 +9,10 @@ class AiProvider extends Model
 {
     use HasFactory;
 
-    public const PROVIDERS = ['openai', 'stability_ai', 'elevenlabs', 'other'];
+    // 'youtube' isn't an AI provider, but reuses this same credentials
+    // shape: api_key holds an OAuth refresh_token, config holds
+    // client_id/client_secret. See YoutubePublishHandler.
+    public const PROVIDERS = ['openai', 'stability_ai', 'elevenlabs', 'youtube', 'other'];
 
     protected $fillable = [
         'name',