feat: add optional browser extension bridge backend

[sleepyy-dog]

Summary

This PR adds an optional browser-extension backend for web-access.

• Adds a Manifest V3 extension under extension/.
• Adds a local WebSocket/HTTP bridge on 127.0.0.1:3457 via scripts/webext-proxy.mjs.
• Adds scripts/check-webext.mjs to start the bridge and report whether the extension is connected.
• Documents the extension backend in references/browser-extension.md and updates SKILL.md / README.md to prefer the extension backend while keeping CDP Proxy as fallback.
• Adds Node tests for WebSocket framing, command forwarding, POST body URL handling, health reporting, and origin restrictions.

Why

The current CDP flow still depends on the browser remote-debugging permission path. The extension backend follows the same broad model as local browser bridges: install/authorize the extension once, then let the local daemon communicate with the extension for normal browser operations.

CDP remains available for unsupported edge cases or workflows that need lower-level DevTools control.

Chrome Web Store question

This PR intentionally keeps the extension as a local unpacked extension. Do you think it is worth publishing this browser bridge to the Chrome Web Store later?

If yes, a follow-up could add store-specific packaging, icons/screenshots, privacy disclosure, release zip generation, and any review notes needed for the debugger permission. If not, the unpacked-extension flow can remain the documented local setup.

Security notes

• The daemon binds to 127.0.0.1 only.
• The extension connects to ws://127.0.0.1:3457/ext.
• The HTTP bridge rejects ordinary web-page Origin headers.
• WebSocket bridge connections are limited to extension origins such as chrome-extension://....
• The extension requests debugger, tabs, and related permissions, so it should be installed from a trusted local checkout.

Validation

• node --test tests/webext-proxy.test.mjs -> 6 passing tests
• node --check scripts/webext-proxy.mjs scripts/webext-proxy-lib.mjs scripts/check-webext.mjs extension/background.js
• Manual smoke test with the extension backend on 127.0.0.1:3457: check-webext reported ready, opened about:blank, evaluated JavaScript, read page info, and closed the tab.
• That smoke test used the extension bridge path and did not require clicking the Chrome / Edge remote-debugging authorization prompt.