Replay: pauses are no longer compressed — steps fire on absolute recorded
clocks (1:1 with the recording), the cursor stays on the track, a 200ms
settle follows scrolls so the next click resolves on the scrolled page,
and the clock re-anchors after page loads (load time is not recorded time).

Version + hot overlay: the extension version now comes from the root
package.json; the server publishes the current version and the overlay
module (overlay.js + overlay.css) at /api/ext/manifest + /api/ext/assets
(POST /api/ext/publish, manifest written last as the commit point). The
content script imports the server overlay straight from its URL — public
assets answer ACAO * because page-origin imports are the only module path
that works in an isolated world (blob/data imports and eval are all
blocked by the MV3 CSP) — and falls back to the statically bundled copy
on any failure; the version gate never downgrades the UI below the core.
Core updates surface as a popup banner linking to /download; the download
page shows the published version and versioned zips (npm run package also
emits them). make ext-publish ships the overlay from a built dist.

E2E covers the whole hot-overlay round trip: publish a marked 9.9.9
overlay, reload → data-overlay-source="remote", popup banner, dead-server
fallback → "bundled", then republish the pristine assets.

Co-Authored-By: Claude Code <noreply@anthropic.com>

- content script debounces window scroll (250ms per pause, like inputs)
  into a "scroll" step; inner-container scrolls are ignored (they bubble
  from the page, so only document/documentElement targets count)
- replay sends replay_scroll to the content script, scaling recorded
  offsets to the current viewport
- "scroll" step type in shared API + server validation; timeline icon,
  AI-prompt coords line and stepTypes i18n (en/ru/uk)
- e2e: tall test page + scroll assertion; wait for composer focus
  instead of fixed delays (full-page stitch can take a while); mkdir
  /tmp/ltt-shots for video download; debug log on failure

Co-Authored-By: Claude Code <noreply@anthropic.com>

- uk.json: full Ukrainian translation, uk added to SUPPORTED_LOCALES with
  the shared slavic plural rules and a language option in settings
- /p/<token> and /r/<token> are now served by the API: it injects
  og:title/description/url/image/video + twitter:card into the panel's
  index.html so Telegram and Jira previews show the project or report
  (title, description, creation date, screenshot/video). Caddy proxies
  those paths to the server; the public origin comes from PUBLIC_BASE_URL
  or the request host. Verified end-to-end through the prod stack.

Co-Authored-By: Claude Code <noreply@anthropic.com>