Findings from the full extension review (0.2.4):
- api.js built "baseUrl/api/v1/..." without stripping a trailing slash —
  "//api/v1/secrets" requests on a base URL saved with one; now stripped
  at the single URL-building point (same trap as the webhook 405).
-SAVE_SETTINGS now triggers a design-pack refetch: the install-time fetch
  runs against the DEFAULT baseUrl, so a user pointing the extension at
  another server would not see that server's pack until browser restart.
- The autofill card failed to fill fields named in russian (логин/почта)
  — username-name matching now covers them (password side already did).
- activeTab removed (never used); manifest description is now
  user-facing. Version 0.2.4, fresh dist zips and release manifest.

Co-Authored-By: Claude Code <noreply@anthropic.com>