Add the streamer-tools API client, with a real HTTP backend per platform

Implements the two read-key-scoped calls in
apps/server/src/obs/plugin.routes.ts: GET /api/obs/:slug/slots and
POST /api/obs/:slug/token.

Three pieces, all in core/ with no OBS dependency:

- stplugin::json -- a small, strict JSON reader. Hand-rolled rather than
  vendoring nlohmann because the only JSON this plugin ever sees is two
  fixed-shape responses from its own server, and the parser has to build on
  three platforms with no package-manager step in CI. It never throws,
  bounds its recursion (kMaxDepth=32) so a hostile response cannot overflow
  the stack inside OBS, rejects trailing garbage, and returns the caller's
  fallback for wrong-typed access instead of aborting.

- stplugin::HttpClient -- a two-method injectable interface, with libcurl
  behind it on Linux/macOS and WinHTTP on Windows. WinHTTP rather than curl
  on Windows because it ships with the OS and does TLS through SChannel: the
  self-hosted winvm-builder runner has no package manager, and per the
  scaffold README does not even have cmake preinstalled. Both backends cap
  the response body at 4 MiB, keep TLS verification on (the read key is a
  credential), and honour a whole-request timeout.

- stplugin::ApiClient -- maps the responses onto an ApiStatus enum that
  distinguishes NotFound (404), Unavailable (503), NetworkError,
  MalformedResponse and InvalidConfig. It deliberately does not claim to
  know whether a 404 was a wrong key or an unknown slug, because the server
  deliberately does not say. Server URLs are normalised the way an operator
  actually pastes them, defaulting to https so the read key is never sent in
  the clear by accident, and redactedUrl() exists so a URL can be logged
  without the key.

Tests (279 checks across two new suites) run at two levels: a fake
HttpClient covering every response and error branch, and a real loopback
HTTP server on 127.0.0.1 driving the actual platform backend -- so libcurl
on Linux/macOS and WinHTTP on Windows are each exercised in CI rather than
assumed. The loopback cases deliberately include the ones that must not hang
OBS: a truncated JSON body, a connection accepted and closed without a
reply, non-HTTP garbage, a dead port, and a stalled server that has to be
cut off by the client's own timeout.

Verified locally on Ubuntu 24.04:
  ctest --test-dir build --output-on-failure -> 4/4 passed
  test_json: 158 checks passed
  test_api_client: 121 checks passed

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RL8abRmgFXkVASHkkqiJbE

core/src/http_winhttp.cpp

@@ -0,0 +1,208 @@
+/*
+streamer-tools OBS Camera Plugin - WinHTTP backend (Windows)
+Copyright (C) 2026 CyberCoveLLC <jknapp85@gmail.com>
+
+This program is free software; you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation; either version 2 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License along
+with this program. If not, see <https://www.gnu.org/licenses/>
+*/
+
+// WinHTTP rather than libcurl on Windows: it ships with the OS, does TLS
+// through SChannel (so no OpenSSL to build or ship), and needs no package
+// manager on the self-hosted `winvm-builder` runner -- which, per the
+// scaffold README, is a bare VM without even cmake preinstalled.
+
+#include "stplugin/http.h"
+
+#include <windows.h>
+#include <winhttp.h>
+
+#include <cstddef>
+#include <string>
+#include <vector>
+
+namespace stplugin {
+
+namespace {
+
+constexpr std::size_t kMaxResponseBytes = 4u * 1024u * 1024u;
+
+std::wstring widen(const std::string &s)
+{
+    if (s.empty())
+        return std::wstring();
+    const int needed = MultiByteToWideChar(CP_UTF8, 0, s.c_str(), static_cast<int>(s.size()), nullptr, 0);
+    if (needed <= 0)
+        return std::wstring();
+    std::wstring out(static_cast<std::size_t>(needed), L'\0');
+    MultiByteToWideChar(CP_UTF8, 0, s.c_str(), static_cast<int>(s.size()), &out[0], needed);
+    return out;
+}
+
+std::string lastErrorMessage(const char *what)
+{
+    return std::string(what) + " failed (GetLastError=" + std::to_string(GetLastError()) + ")";
+}
+
+/// RAII for the three WinHTTP handle kinds, which all close the same way.
+class Handle {
+public:
+    Handle() = default;
+    explicit Handle(HINTERNET h) : h_(h) {}
+    ~Handle()
+    {
+        if (h_)
+            WinHttpCloseHandle(h_);
+    }
+    Handle(const Handle &) = delete;
+    Handle &operator=(const Handle &) = delete;
+
+    void reset(HINTERNET h)
+    {
+        if (h_)
+            WinHttpCloseHandle(h_);
+        h_ = h;
+    }
+    HINTERNET get() const { return h_; }
+    explicit operator bool() const { return h_ != nullptr; }
+
+private:
+    HINTERNET h_ = nullptr;
+};
+
+class WinHttpClient : public HttpClient {
+public:
+    HttpResponse send(const HttpRequest &request) override
+    {
+        HttpResponse response;
+
+        const std::wstring url = widen(request.url);
+        if (url.empty()) {
+            response.network_error = "empty or non-UTF-8 URL";
+            return response;
+        }
+
+        URL_COMPONENTS parts{};
+        parts.dwStructSize = sizeof(parts);
+        wchar_t host[256] = {0};
+        wchar_t path[4096] = {0};
+        wchar_t extra[4096] = {0};
+        parts.lpszHostName = host;
+        parts.dwHostNameLength = static_cast<DWORD>(sizeof(host) / sizeof(host[0]));
+        parts.lpszUrlPath = path;
+        parts.dwUrlPathLength = static_cast<DWORD>(sizeof(path) / sizeof(path[0]));
+        parts.lpszExtraInfo = extra;
+        parts.dwExtraInfoLength = static_cast<DWORD>(sizeof(extra) / sizeof(extra[0]));
+
+        if (!WinHttpCrackUrl(url.c_str(), static_cast<DWORD>(url.size()), 0, &parts)) {
+            response.network_error = lastErrorMessage("WinHttpCrackUrl");
+            return response;
+        }
+        if (parts.nScheme != INTERNET_SCHEME_HTTP && parts.nScheme != INTERNET_SCHEME_HTTPS) {
+            response.network_error = "unsupported URL scheme";
+            return response;
+        }
+
+        Handle session(WinHttpOpen(L"streamer-tools-obs-plugin/1.0", WINHTTP_ACCESS_TYPE_AUTOMATIC_PROXY,
+                                   WINHTTP_NO_PROXY_NAME, WINHTTP_NO_PROXY_BYPASS, 0));
+        if (!session) {
+            response.network_error = lastErrorMessage("WinHttpOpen");
+            return response;
+        }
+
+        const DWORD timeout = static_cast<DWORD>(request.timeout_ms);
+        WinHttpSetTimeouts(session.get(), static_cast<int>(timeout), static_cast<int>(timeout),
+                           static_cast<int>(timeout), static_cast<int>(timeout));
+
+        Handle connect(WinHttpConnect(session.get(), host, parts.nPort, 0));
+        if (!connect) {
+            response.network_error = lastErrorMessage("WinHttpConnect");
+            return response;
+        }
+
+        std::wstring target(path);
+        target += extra;
+
+        const DWORD flags = (parts.nScheme == INTERNET_SCHEME_HTTPS) ? WINHTTP_FLAG_SECURE : 0u;
+        Handle req(WinHttpOpenRequest(connect.get(), widen(request.method).c_str(), target.c_str(), nullptr,
+                                      WINHTTP_NO_REFERER, WINHTTP_DEFAULT_ACCEPT_TYPES, flags));
+        if (!req) {
+            response.network_error = lastErrorMessage("WinHttpOpenRequest");
+            return response;
+        }
+
+        std::wstring headers;
+        if (!request.content_type.empty())
+            headers = L"Content-Type: " + widen(request.content_type) + L"\r\n";
+
+        const LPCWSTR header_ptr = headers.empty() ? WINHTTP_NO_ADDITIONAL_HEADERS : headers.c_str();
+        const DWORD header_len = headers.empty() ? 0u : static_cast<DWORD>(headers.size());
+
+        void *body_ptr = request.body.empty() ? WINHTTP_NO_REQUEST_DATA
+                                              : const_cast<char *>(request.body.data());
+        const DWORD body_len = static_cast<DWORD>(request.body.size());
+
+        if (!WinHttpSendRequest(req.get(), header_ptr, header_len, body_ptr, body_len, body_len, 0)) {
+            response.network_error = lastErrorMessage("WinHttpSendRequest");
+            return response;
+        }
+        if (!WinHttpReceiveResponse(req.get(), nullptr)) {
+            response.network_error = lastErrorMessage("WinHttpReceiveResponse");
+            return response;
+        }
+
+        DWORD status = 0;
+        DWORD status_size = sizeof(status);
+        if (!WinHttpQueryHeaders(req.get(), WINHTTP_QUERY_STATUS_CODE | WINHTTP_QUERY_FLAG_NUMBER,
+                                 WINHTTP_HEADER_NAME_BY_INDEX, &status, &status_size, WINHTTP_NO_HEADER_INDEX)) {
+            response.network_error = lastErrorMessage("WinHttpQueryHeaders");
+            return response;
+        }
+        response.status = static_cast<long>(status);
+
+        std::string body;
+        for (;;) {
+            DWORD available = 0;
+            if (!WinHttpQueryDataAvailable(req.get(), &available)) {
+                response.network_error = lastErrorMessage("WinHttpQueryDataAvailable");
+                return response;
+            }
+            if (available == 0)
+                break;
+            if (body.size() + available > kMaxResponseBytes) {
+                response.network_error = "response body exceeded 4 MiB";
+                return response;
+            }
+            std::vector<char> chunk(available);
+            DWORD read = 0;
+            if (!WinHttpReadData(req.get(), chunk.data(), available, &read)) {
+                response.network_error = lastErrorMessage("WinHttpReadData");
+                return response;
+            }
+            if (read == 0)
+                break;
+            body.append(chunk.data(), read);
+        }
+
+        response.body = std::move(body);
+        return response;
+    }
+};
+
+} // namespace
+
+HttpClient *createPlatformHttpClient()
+{
+    return new WinHttpClient();
+}
+
+} // namespace stplugin