- Settings-drawer save feedback used to live at the bottom of the drawer
  body: clipped at real popup height and destroyed 800ms later when the
  drawer node was removed. Success now rides a kit toast on document.body
  (outlives the drawer, always in viewport); the drawer closes 1600ms in.
- All alert wraps moved to the top of the drawer body so errors never sit
  under the fold.
- Kit Drawer quirk fixed at the call sites: close() leaves a-hide on the
  element and the class survives the node removal, so reopening the
  settings drawer slid the panel back out of view — every reopen clears
  the stale class first.
- Titles: static HTML title + runtime localized popupTitle (new pack
  string, en/uk/ru); manifest renamed GNEXUS CREDS; version 0.2.3 with
  fresh dist zips and pack v25.

Co-Authored-By: Claude Code <noreply@anthropic.com>

CSS (card + popup), field-detection keyword tables and UI config now ship as
extensions/pack/ with sha256 in pack.json and a monotonic version. The backend
serves pack.json unauthenticated (no-cache) and files versioned/immutable; a
background-worker sync validates schema, ext-version compatibility and hashes,
then stores the pack atomically in chrome.storage.local — content scripts and
the popup only read storage, never fetch, and fall back to the bundled
defaults. Publish tool auto-bumps on content change and writes pack.json last.
Firefox bundle inlines pack-shared.js; release 0.2.0.

E2E (15/15): adoption, live restyle without re-release, rollback and
min-extension guards, sha-mismatch abort, offline fallback. Tests: node 25+21,
pytest 57.

Co-Authored-By: Claude Code <noreply@anthropic.com>

Move the gnexus-creds-extension sources (Chrome/Firefox MV3) from the
separate sibling repository into extensions/extension/ so builds live
next to the packaged releases this service distributes
 (extensions/dist/ + extensions/manifest.json, untouched).

- add a reproducible `make lib` target materializing lib/ from the
  frontend's pinned gnexus-ui-kit (gitignored, like before)
- drop the playwright-only package.json/lock; system node+zip suffice
- scoped .gitignore so it cannot shadow tracked extensions/dist zips
- README (main + extension): document the in-repo build and publish flow

Rebuilt zips differ from released ones only in the three lib files
(older kit in the release); extension code itself is byte-identical.

Co-Authored-By: Claude Code <noreply@anthropic.com>