Replay at recorded pace; extension version check + hot overlay from the server ...

Replay: pauses are no longer compressed — steps fire on absolute recorded
clocks (1:1 with the recording), the cursor stays on the track, a 200ms
settle follows scrolls so the next click resolves on the scrolled page,
and the clock re-anchors after page loads (load time is not recorded time).

Version + hot overlay: the extension version now comes from the root
package.json; the server publishes the current version and the overlay
module (overlay.js + overlay.css) at /api/ext/manifest + /api/ext/assets
(POST /api/ext/publish, manifest written last as the commit point). The
content script imports the server overlay straight from its URL — public
assets answer ACAO * because page-origin imports are the only module path
that works in an isolated world (blob/data imports and eval are all
blocked by the MV3 CSP) — and falls back to the statically bundled copy
on any failure; the version gate never downgrades the UI below the core.
Core updates surface as a popup banner linking to /download; the download
page shows the published version and versioned zips (npm run package also
emits them). make ext-publish ships the overlay from a built dist.

E2E covers the whole hot-overlay round trip: publish a marked 9.9.9
overlay, reload → data-overlay-source="remote", popup banner, dead-server
fallback → "bundled", then republish the pristine assets.

Co-Authored-By: Claude Code <noreply@anthropic.com>

Ukrainian localization; link-preview meta tags on share pages ...

- uk.json: full Ukrainian translation, uk added to SUPPORTED_LOCALES with
  the shared slavic plural rules and a language option in settings
- /p/<token> and /r/<token> are now served by the API: it injects
  og:title/description/url/image/video + twitter:card into the panel's
  index.html so Telegram and Jira previews show the project or report
  (title, description, creation date, screenshot/video). Caddy proxies
  those paths to the server; the public origin comes from PUBLIC_BASE_URL
  or the request host. Verified end-to-end through the prod stack.

Co-Authored-By: Claude Code <noreply@anthropic.com>

Server: FastAPI backend with auth, projects, reports, uploads ...

- FastAPI + SQLAlchemy async + Alembic, PostgreSQL in docker-compose
- Auth: argon2id, cookie sessions (web) + bearer tokens (extension)
- Unguessable share tokens (128-bit) on projects and reports
- Content-addressed file storage with mime sniffing, token-scoped download
- Reports with nested steps; server-side password masking

Co-Authored-By: Claude Code <noreply@anthropic.com>