Review fixes: trailing-slash URLs, pack refetch on server change, ru autofill ...

Findings from the full extension review (0.2.4):
- api.js built "baseUrl/api/v1/..." without stripping a trailing slash —
  "//api/v1/secrets" requests on a base URL saved with one; now stripped
  at the single URL-building point (same trap as the webhook 405).
-SAVE_SETTINGS now triggers a design-pack refetch: the install-time fetch
  runs against the DEFAULT baseUrl, so a user pointing the extension at
  another server would not see that server's pack until browser restart.
- The autofill card failed to fill fields named in russian (логин/почта)
  — username-name matching now covers them (password side already did).
- activeTab removed (never used); manifest description is now
  user-facing. Version 0.2.4, fresh dist zips and release manifest.

Co-Authored-By: Claude Code <noreply@anthropic.com>

Save feedback becomes a body-level toast; popup is GNEXUS CREDS again ...

- Settings-drawer save feedback used to live at the bottom of the drawer
  body: clipped at real popup height and destroyed 800ms later when the
  drawer node was removed. Success now rides a kit toast on document.body
  (outlives the drawer, always in viewport); the drawer closes 1600ms in.
- All alert wraps moved to the top of the drawer body so errors never sit
  under the fold.
- Kit Drawer quirk fixed at the call sites: close() leaves a-hide on the
  element and the class survives the node removal, so reopening the
  settings drawer slid the panel back out of view — every reopen clears
  the stale class first.
- Titles: static HTML title + runtime localized popupTitle (new pack
  string, en/uk/ru); manifest renamed GNEXUS CREDS; version 0.2.3 with
  fresh dist zips and pack v25.

Co-Authored-By: Claude Code <noreply@anthropic.com>

Revoked tokens stop being invisible: popup plate + token ID, tokens table columns ...

Extension 0.2.2: a 401 from any API call flips a tokenInvalid flag that the
popup renders as a dedicated plate (same load, via status propagation from
the background, plus the pre-flagged check on popup open); the Settings
drawer shows the stored token's public ID so it can be matched against the
tokens table. Web: Tokens tab gains Public ID / Created / Last used columns.
Design pack v24 ships the new strings (en/uk/ru); served zips rehashed.

Co-Authored-By: Claude Code <noreply@anthropic.com>

Splash over the empty shell on sign-in; extension v0.2.1 catches submit() logins ...

- App.vue gates on auth state: 'checking' renders a logo + spinner card
  until /me answers, so the shell never flashes empty before the
  sign-in screen appears; 'denied' -> sign-in card, 'ready' -> app.
- content.js: DLE-style <button onclick="submit();"> calls
  form.submit(), which fires no submit event - the login form's
  interceptor stayed silent (animaunt.org regression). Capture happens
  on the submit-button click and Enter too; duplicate captures within
  1.5s with identical credentials are dropped. Verified end-to-end on
  animaunt.org: modal login -> popup save card -> vault entry.
- Release 0.2.1: Makefile + extension manifest bumped, zips rebuilt
  and hashed into the deploy manifest for the download page.

Co-Authored-By: Claude Code <noreply@anthropic.com>

Serve 0.2.0 extension builds from the download page ...

extensions/manifest.json advertised the 0.2.0 filenames while the served
extensions/dist still held the 0.1.1 zips — the page filtered unknown
files and shipped an empty build list, so download buttons never
appeared. Ship the current 0.2.0 builds and refresh their sha256/size,
drop the 0.1.1 zips.

Co-Authored-By: Claude Code <noreply@anthropic.com>

Release extension 0.1.1: kit 1.0 lib, shield logo icons ...

Rebuild both browsers' packages against gnexus-ui-kit 1.0 (make lib
from frontend/node_modules) and swap the generic dots mark for the
shield keyhole logo rasterized from frontend/public/logo.svg
(icon.svg + 16/32/48/128 PNG rsvg-convert). Popup verified in
chromium: settings drawer and secrets list render with no page errors.
Version bumped in extension manifest + Makefile; extensions/manifest.json
points at the 0.1.1 zips with fresh sha256/size (0.1.0 zips removed).

Co-Authored-By: Claude Code <noreply@anthropic.com>

Refresh extension builds (split Chrome/Firefox) ...

Repackage the Chrome and Firefox builds from the extension repo and
update extensions/manifest.json checksums, sizes, and release date.

Co-Authored-By: Claude <noreply@anthropic.com>

Add in-app extension download page ...

Distribute the gnexus-creds browser extension from the service itself.
Package Chrome and Firefox builds into extensions/dist/ with a manifest
describing version, checksums, and sizes; serve them via authenticated
FastAPI endpoints and surface a new Extension tab in the Vue UI with
download cards, SHA-256, and install instructions.

Co-Authored-By: Claude <noreply@anthropic.com>