Play videos on sprites, converted on the server with clips (#402)

A video becomes an asset like a sound: uploaded once, converted to one
format by a worker of its own, cut into clips in its tab, and worn by a
sprite through its Texture row. Only Chrome is a target, without alpha.

- Server: POST ?r=videos queues the upload under the hash of its bytes,
  so the MP4's name is known at once. The worker (VideoWorker over
  VideoFormat) writes H.264/AAC, yuv420p, constant frame rate, a
  keyframe every 15 frames, at most 1920x1080, with a poster and the
  details beside it. A failed job says why and is tried again on the
  next upload.
- An upload may be up to 2 GB. It is streamed from the request to disk
  and hashed there, so php-fpm holds none of it in memory. The other
  routes keep their 256 MB.
- The worker runs in the container game-maker-video on stein2, a
  compose project of its own (tools/video/), and in CI beside the PHP
  server. The CI image has ffmpeg for it.
- Model: asset type video with size, length, frame rate and sound, and
  clips like a sound's. The clip helpers and commands serve both.
- A sprite's Texture row offers videos and clips after the pictures.
  resolvePicture names a playing video by a key, and the texture library
  hands it to a VideoLibrary with one player per key.
- The editor shows a placed video as a quiet preview. Play starts it
  over at its clip's start and lets it be heard through the master bus,
  a pause holds it, Esc makes it quiet again.
- Video tab: the picture, a ruler, the clip strip and a track on the
  Sound tab's time axis. A drag spans a clip, a handle moves an edge,
  Play plays the picked clip.
- The picker shows a video on its way with its progress and adopts an
  upload from it once it is ready. Dropping a video file does the same.

Decided on my own:

- Two sprites wearing the same clip share one player and show the same
  picture. Control per instance belongs to the follow-up with nodes.
- A video plays in real time, the game's time scale does not slow it.
- The container may use 3 of the 4 cores of stein2.

Findings:

- The first real upload (279 MB) got 413: the API's own ceiling of
  256 MB for every request, not nginx or the Brandmauer.
- Chrome has no picture of a video that never played, and a Pixi
  VideoSource drawn before the first frame stays empty for good. The
  texture is made in the first frame callback (openVideo).
- A player nobody asks for in 2 s is let go. The inspector's PREVIEW
  asked only on an edit, so with the sprite not on screen its texture
  was destroyed under it and the batcher threw on every frame. The
  preview now redraws every frame while it shows a video, like a Time
  shader. A let-go texture keeps an empty source instead of none.
- VideoSource.load() reloads the element and cuts off an earlier
  play(). Playing starts after loadeddata.

Tests:

- PHP videos.test.php: 68 checks, with the real ffmpeg
- 300 MB upload through Brandmauer and nginx: 201 in 21 s, php-fpm at
  13.7 MB RSS at most
- Unit videos.test.ts: 20 tests
- e2e 66 (stein2, atx was off): ALL PASSED, 18 checks; e2e 04 with the
  new asset count green
- Gate (atx): 294 files, 4520 tests. serialize.test.ts used video as
  its example of an unknown type and now uses a made-up one.
- Counter-checks: a keyframe gap of 30 fails the PHP check, a key that
  keeps the video's end fails 2 unit tests, a clip without its end
  fails "plays only its stretch" in e2e 66

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

api/index.php

@@ -63,6 +63,13 @@ declare(strict_types=1);
  *   POST   ?r=sounds&name=x.wav   raw sound bytes    → {file,name,bytes}
  *   DELETE ?r=sounds/{file}       → 204 | 403 | 404 | 409
  *
+ *   GET    ?r=videos              → [{file,name,status,…,owner,deletable}]
+ *   POST   ?r=videos&name=x.mov   raw video bytes    → {file,name,status,…}
+ *   DELETE ?r=videos/{file}       → 204 | 403 | 404 | 409
+ *                               (an upload is converted by the worker in `game-maker-video` (#402):
+ *                                `status` is queued, converting with `progress`, failed with `error`,
+ *                                or ready with width, height, duration, fps, audio and `poster`)
+ *
  * Uploads land in the uploader's own folder, and `file` carries it: `{folder}/{sha256}.{ext}`
  * (#344). A `file` without a folder belongs to nobody. A list shows the files of the one asking and
  * nobody's, an administrator's every file; `owner` is the account a file belongs to (null for
@@ -78,8 +85,8 @@ declare(strict_types=1);
  * empty when none is known. It is a caption, never a path: the stored file is always `{hash}.{ext}`
  * in a folder.
  *
- * Stored images, fonts, sounds and cels are served straight from `data/textures/`, `data/fonts/`,
- * `data/sounds/` and `data/pixels/` as static files; the API only writes them.
+ * Stored images, fonts, sounds, videos and cels are served straight from `data/textures/`, `data/fonts/`,
+ * `data/sounds/`, `data/videos/` and `data/pixels/` as static files; the API only writes them.
  */
 
 require __DIR__ . '/lib/AccountRules.php';
@@ -99,8 +106,13 @@ require __DIR__ . '/lib/SoundStore.php';
 require __DIR__ . '/lib/Store.php';
 require __DIR__ . '/lib/TextureStore.php';
 require __DIR__ . '/lib/UserStore.php';
+require __DIR__ . '/lib/VideoQueue.php';
+require __DIR__ . '/lib/VideoStore.php';
 
-/** Has to clear the largest single upload below, which is a sound; the web server has its own say. */
+/**
+ * Has to clear the largest upload held in memory, which is a sound; a video is streamed to disk and
+ * has its own ceiling. The web server and the proxy in front of it have their own say.
+ */
 const MAX_BODY_BYTES = 256 * 1024 * 1024;
 
 /** Upload ceiling for a single image. The editor downscales larger pictures before sending. */
@@ -112,6 +124,12 @@ const MAX_FONT_BYTES = 4 * 1024 * 1024;
 /** The same for a sound, far higher: a recorded take is plain WAV, about 46 minutes in mono. */
 const MAX_SOUND_BYTES = 256 * 1024 * 1024;
 
+/**
+ * A video goes up as it was recorded and is made smaller by the worker, not on the way. It is
+ * streamed to disk, so memory is no limit; nginx and the Brandmauer let 2 GB through (#402).
+ */
+const MAX_VIDEO_BYTES = 2048 * 1024 * 1024;
+
 set_error_handler(static function (int $severity, string $message, string $file, int $line): bool {
     // PHP calls the handler for a call silenced with `@` as well, only with less reported: that
     // warning was expected and is answered where it happens (an unreadable image is a 422).
@@ -514,12 +532,21 @@ function routeFiles(
             Response::json($store->list($users->folderOf($user), $isAdmin, $users->folderOwners()));
         }
         if ($method === 'POST') {
-            $bytes = Response::rawBody();
-            if (strlen($bytes) > $maxBytes) {
-                Response::error("{$noun} must be at most " . ($maxBytes / 1024 / 1024) . ' MB', 413);
-            }
+            $tooLarge = "{$noun} must be at most " . ($maxBytes / 1024 / 1024) . ' MB';
+            $name = (string) ($_GET['name'] ?? '');
             try {
-                Response::json($store->store($bytes, (string) ($_GET['name'] ?? ''), $users->folderOf($user, true)), 201);
+                // A video is too big for memory and goes from the request straight to disk.
+                if ($store instanceof VideoStore) {
+                    $in = fopen('php://input', 'rb');
+                    Response::json($store->storeStream($in, $maxBytes, $name, $users->folderOf($user, true)), 201);
+                }
+                $bytes = Response::rawBody();
+                if (strlen($bytes) > $maxBytes) {
+                    Response::error($tooLarge, 413);
+                }
+                Response::json($store->store($bytes, $name, $users->folderOf($user, true)), 201);
+            } catch (VideoTooLargeException) {
+                Response::error($tooLarge, 413);
             } catch (RuntimeException $e) {
                 if (!$e instanceof $invalid) {
                     throw $e;
@@ -600,19 +627,20 @@ function routePlugins(array $parts, string $method): never
 }
 
 try {
-    if ((int) ($_SERVER['CONTENT_LENGTH'] ?? 0) > MAX_BODY_BYTES) {
-        Response::error('Request body too large', 413);
-    }
-
     $method = $_SERVER['REQUEST_METHOD'] ?? 'GET';
     $route = trim((string) ($_GET['r'] ?? ''), '/');
     $parts = $route === '' ? [] : explode('/', $route);
 
+    $maxBody = ($parts[0] ?? '') === 'videos' ? MAX_VIDEO_BYTES : MAX_BODY_BYTES;
+    if ((int) ($_SERVER['CONTENT_LENGTH'] ?? 0) > $maxBody) {
+        Response::error('Request body too large', 413);
+    }
+
     // A project reaches deepest, `projects/{id}/snapshots/{snapshotId}/restore`; a stored file is
     // `textures/{folder}/{file}`; everything else stops at two parts.
     $depth = match ($parts[0] ?? '') {
         'projects' => 5,
-        'textures', 'fonts', 'sounds' => 3,
+        'textures', 'fonts', 'sounds', 'videos' => 3,
         default => 2,
     };
     if (count($parts) < 1 || count($parts) > $depth) {
@@ -671,6 +699,17 @@ try {
             'Sound',
             InvalidSoundException::class,
         ),
+        'videos' => routeFiles(
+            $parts,
+            $method,
+            $user,
+            $isAdmin,
+            $users,
+            new VideoStore("{$data}/videos"),
+            MAX_VIDEO_BYTES,
+            'Video',
+            InvalidVideoException::class,
+        ),
         'pixels' => routePixels($parts, $method),
         'plugins' => routePlugins($parts, $method),
         default => Response::error('Not found', 404),