- App.vue gates on auth state: 'checking' renders a logo + spinner card
  until /me answers, so the shell never flashes empty before the
  sign-in screen appears; 'denied' -> sign-in card, 'ready' -> app.
- content.js: DLE-style <button onclick="submit();"> calls
  form.submit(), which fires no submit event - the login form's
  interceptor stayed silent (animaunt.org regression). Capture happens
  on the submit-button click and Enter too; duplicate captures within
  1.5s with identical credentials are dropped. Verified end-to-end on
  animaunt.org: modal login -> popup save card -> vault entry.
- Release 0.2.1: Makefile + extension manifest bumped, zips rebuilt
  and hashed into the deploy manifest for the download page.

Co-Authored-By: Claude Code <noreply@anthropic.com>