YouTube account settings, faster cold loads, album column

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,46 @@
+name: Bug report
+description: Something in the app is broken or behaves wrong
+labels: [bug]
+body:
+  - type: textarea
+    id: what
+    attributes:
+      label: What happens
+      description: What you did, what you expected, and what you got instead.
+      placeholder: |
+        1. Opened a playlist
+        2. Clicked the third video
+        3. Player stays black, audio plays
+    validations:
+      required: true
+
+  - type: input
+    id: version
+    attributes:
+      label: Zuno version
+      description: Settings → About, or the installer filename.
+      placeholder: "1.2.1"
+    validations:
+      required: true
+
+  - type: dropdown
+    id: os
+    attributes:
+      label: OS
+      options:
+        - Windows
+        - macOS
+        - Linux
+    validations:
+      required: true
+
+  - type: textarea
+    id: logs
+    attributes:
+      label: Log
+      description: |
+        `current.log` from the log directory — it usually says what failed.
+        Windows: `%LOCALAPPDATA%\com.zuno.desktop\logs`
+        macOS: `~/Library/Logs/com.zuno.desktop`
+        Linux: `~/.local/share/com.zuno.desktop/logs`
+      render: text

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,11 @@
+# Blank issues stay on: not every report fits a form, and a bad-fit form is how a real
+# bug turns into no report at all.
+blank_issues_enabled: true
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/noFAYZ/zuno/security/advisories/new
+    about: Report privately, not as a public issue. See SECURITY.md for scope.
+
+  - name: Question or help using Zuno
+    url: https://github.com/noFAYZ/zuno/discussions/new?category=q-a
+    about: Not sure whether it is a bug? Ask here — it can be moved to an issue.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,17 @@
+name: Feature request
+description: Suggest something Zuno should do
+labels: [enhancement]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: The problem
+      description: What are you trying to do that Zuno makes hard or impossible today?
+    validations:
+      required: true
+
+  - type: textarea
+    id: idea
+    attributes:
+      label: What you have in mind
+      description: Optional. A rough idea is fine — the problem above matters more.

.github/dependabot.yml

@@ -0,0 +1,33 @@
+# Dependency updates. Monthly, grouped into one PR per ecosystem — zuno has a single
+# maintainer, and a weekly drip of five separate PRs is how update PRs get ignored.
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: monthly
+    groups:
+      npm:
+        patterns: ["*"]
+
+  - package-ecosystem: npm
+    directory: /landing
+    schedule:
+      interval: monthly
+    groups:
+      landing:
+        patterns: ["*"]
+
+  - package-ecosystem: cargo
+    directory: /src-tauri
+    schedule:
+      interval: monthly
+    groups:
+      cargo:
+        patterns: ["*"]
+
+  # Ungrouped: an action bump is one line and worth reading on its own.
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly

.github/pull_request_template.md

@@ -0,0 +1,18 @@
+## What and why
+
+<!-- What changed, and the problem it solves. One paragraph is plenty. -->
+
+Closes #
+
+## How it was checked
+
+<!-- Delete what does not apply. -->
+
+- [ ] `npm run verify` passes
+- [ ] `cargo test` passes (if `src-tauri/` changed)
+- [ ] Ran the app and used the affected screen
+- [ ] Screenshot or clip below (UI changes)
+
+## Notes for the reviewer
+
+<!-- Anything non-obvious: a tradeoff, a shortcut left in, a follow-up needed. -->

.github/rulesets/README.md

@@ -0,0 +1,27 @@
+# Rulesets
+
+Rulesets are repository *settings*, not configuration GitHub reads from the tree — a file here
+does nothing until it is imported. It lives in the repo so the protection on `main` is reviewable
+in a diff instead of being a thing someone once clicked.
+
+Apply or update:
+
+```sh
+gh api --method PUT repos/noFAYZ/zuno/rulesets/20021321 --input .github/rulesets/main.json
+```
+
+`main.json` is applied — id `20021321`, created 2026-07-30. Edit the file, run the command, and the
+two stay in step; skip the command and the file is fiction. `gh api repos/noFAYZ/zuno/rulesets`
+lists what is actually live. The UI equivalent is Settings → Rules → Rulesets.
+
+## What `main.json` does
+
+- No deletion, no force-push.
+- Changes arrive by pull request. **Zero** approvals required — this is a solo-maintained repo, and
+  a review count of one would lock the maintainer out of their own default branch, since nobody can
+  approve their own PR.
+- `verify` and `rust` — both CI jobs — must pass first. Not strict: a branch does not have to be
+  rebased onto the newest `main` before merging, which on a repo this size is churn without a
+  matching risk.
+- No bypass actors. An admin can still edit the ruleset itself, so the escape hatch exists without
+  a standing exemption that quietly makes the rules advisory.

.github/rulesets/main.json

@@ -0,0 +1,35 @@
+{
+  "name": "main",
+  "target": "branch",
+  "enforcement": "active",
+  "conditions": {
+    "ref_name": {
+      "include": ["~DEFAULT_BRANCH"],
+      "exclude": []
+    }
+  },
+  "bypass_actors": [],
+  "rules": [
+    { "type": "deletion" },
+    { "type": "non_fast_forward" },
+    {
+      "type": "pull_request",
+      "parameters": {
+        "required_approving_review_count": 0,
+        "dismiss_stale_reviews_on_push": false,
+        "require_code_owner_review": false,
+        "require_last_push_approval": false,
+        "required_review_thread_resolution": false,
+        "allowed_merge_methods": ["merge", "squash", "rebase"]
+      }
+    },
+    {
+      "type": "required_status_checks",
+      "parameters": {
+        "strict_required_status_checks_policy": false,
+        "do_not_enforce_on_create": false,
+        "required_status_checks": [{ "context": "verify" }, { "context": "rust" }]
+      }
+    }
+  ]
+}

.github/workflows/aur.yml

@@ -0,0 +1,108 @@
+# Publishes zuno to the AUR whenever a release is published.
+#
+# Runs from CI because the AUR needs an Arch environment and an SSH key, and the maintainer
+# develops on Windows — doing this by hand meant either a VM or the package going stale.
+#
+# Requires one repository secret:
+#   AUR_SSH_PRIVATE_KEY — the private half of the SSH key registered on the AUR account
+name: AUR
+
+on:
+  release:
+    types: [published]
+  # Lets a botched package be re-pushed without cutting another release.
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Version to publish, without the leading v (e.g. 1.2.1)"
+        required: true
+
+# Publishing happens over SSH to the AUR, not through the GitHub token.
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    container: archlinux:base-devel
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Resolve version
+        id: version
+        run: |
+          if [ -n "${{ github.event.inputs.version }}" ]; then
+            version="${{ github.event.inputs.version }}"
+          else
+            version="${GITHUB_REF_NAME#v}"
+          fi
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+
+      - name: Install packaging tools
+        run: |
+          pacman -Syu --noconfirm --needed git openssh pacman-contrib sudo
+          # makepkg and everything built on it — updpkgsums, --printsrcinfo — refuse to run
+          # as root, and the container is root. One unprivileged user serves all of them.
+          useradd -m builder
+          # `makepkg -s` installs the declared dependencies, which needs pacman.
+          echo 'builder ALL=(ALL) NOPASSWD: ALL' > /etc/sudoers.d/builder
+
+      - name: Update version and checksum
+        working-directory: packaging/aur/zuno
+        run: |
+          version="${{ steps.version.outputs.version }}"
+          sed -i "s/^pkgver=.*/pkgver=${version}/" PKGBUILD
+          sed -i "s/^pkgrel=.*/pkgrel=1/" PKGBUILD
+          chown -R builder .
+          # updpkgsums downloads the released .deb and rewrites sha256sums from what actually
+          # shipped, rather than trusting a hash edited by hand alongside the version.
+          #
+          # .SRCINFO is what the AUR reads — not the PKGBUILD — so a stale one silently serves
+          # the old version even after a successful push.
+          su builder -c "updpkgsums && makepkg --printsrcinfo > .SRCINFO"
+
+      - name: Build it before anyone else has to
+        working-directory: packaging/aur/zuno
+        run: su builder -c "makepkg -sf --noconfirm"
+
+      - name: Publish
+        env:
+          AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
+        run: |
+          version="${{ steps.version.outputs.version }}"
+
+          mkdir -p ~/.ssh
+          echo "$AUR_SSH_PRIVATE_KEY" > ~/.ssh/aur
+          chmod 600 ~/.ssh/aur
+          # `accept-new` rather than a keyscan: a keyscan that returns nothing fails silently
+          # and leaves an empty known_hosts, which is what broke the first run. This trusts
+          # the host on first contact and pins it for the rest of the job, and unlike
+          # StrictHostKeyChecking=no it still rejects a key that changes mid-run.
+          export GIT_SSH_COMMAND="ssh -i ~/.ssh/aur -o StrictHostKeyChecking=accept-new -o UserKnownHostsFile=$HOME/.ssh/known_hosts"
+
+          git config --global user.name "${{ github.actor }}"
+          git config --global user.email "${{ github.actor }}@users.noreply.github.com"
+
+          # A package that does not exist yet clones as an empty repo rather than failing, so
+          # the first run creates it and every run after updates it. That matters because the
+          # maintainer is on Windows: without this, publishing would need a Linux box once,
+          # purely to make the initial commit.
+          git clone ssh://aur@aur.archlinux.org/zuno.git /tmp/aur || {
+            echo "No AUR repo yet — initialising one."
+            mkdir -p /tmp/aur
+            git -C /tmp/aur init -b master
+            git -C /tmp/aur remote add origin ssh://aur@aur.archlinux.org/zuno.git
+          }
+
+          # Only these two files belong in an AUR repo — no sources, no built packages.
+          cp packaging/aur/zuno/PKGBUILD packaging/aur/zuno/.SRCINFO /tmp/aur/
+
+          cd /tmp/aur
+          # `--quiet` alone reports nothing on a fresh repo where the files are untracked.
+          git add PKGBUILD .SRCINFO
+          if git diff --cached --quiet; then
+            echo "AUR already at ${version}, nothing to push."
+            exit 0
+          fi
+          git commit -m "zuno ${version}"
+          git push -u origin master