chore(youtube): enumerate parent origins in api/youtube/embed.js and fix its stale doc entry

Why

api/youtube/embed.js:13-22 still matches ^https:\/\/(.*\.)?worldmonitor\.app$. It is the last suffix match on that domain. convex/payments/returnUrlOrigin.ts:11-16 enumerates app hosts because clerk. and abacus. are vendor CNAMEs, and #8171 applies the same enumeration to CORS.

Probe on 2026-09-15: embed.js accepts https://abacus.worldmonitor.app, https://clerk.worldmonitor.app, and https://anything-future.worldmonitor.app as parentOrigin. isTrustedReturnUrlOrigin refuses all three.

Why this is hygiene, not a vulnerability

The deployed route answers with frame-ancestors enumerated to the app hosts and x-frame-options: SAMEORIGIN, so a vendor page cannot frame the wrapper. The route has no production caller. Web embeds youtube.com directly (src/components/LiveWebcamsPanel.ts:329) and desktop uses the sidecar (LiveWebcamsPanel.ts:326, src-tauri/sidecar/local-api-server.mjs:1497).

Do

1. Replace the suffix regex with the enumerated app origins (or import TRUSTED_RETURN_URL_ORIGINS). Keep the team-pinned preview pattern and the localhost and tauri entries.
2. Fix docs/api-notifications.mdx:97. It says the route exists "to bypass WKWebView autoplay restrictions on the desktop app", which the sidecar route does.
3. Decide whether to retire the hosted route. api/api-route-exceptions.json:483 and shared/source-attribution-manifest.json list it.

Found during the 2026-09-15 security-validation batch (YoutubeEmbedParentOriginVendorCnameSuffix outcome, closed no-change).