Cloud sync of profiles and preferences through byte.vet - #71

Sync profiles and preferences (theme, language, toolbar action) across
browsers and devices with a byte.vet account, per docs/sync-protocol.md.

- Sign-in: OAuth 2.1 code + PKCE via identity.launchWebAuthFlow, run from
  the Preference page. Refresh tokens rotate under a cross-context lock;
  requests never send byte.vet cookies (its auth server refuses
  cookie-bearing POSTs).
- Engine: per-record last-writer-wins by hybrid logical clock, tombstones,
  full resync after cursor_expired, held records of unknown schemas,
  per-device "This device only" profiles, first-sign-in choice (merge,
  use cloud, upload). No outbox: pending changes survive service worker
  restarts.
- Background: sync at start, after sign-in, 2 s after a local change and
  every 15 min; typed sync:* messages for the UI.
- UI: Sync section on the Preference page, first-sync modal, snapshot
  restore, and the "This device only" switch in the profile editor.
- Build: PROXYVERSE_ENV (production, northernlight, e2e) picks the server
  and OAuth client; Chrome dev builds carry a dev key for a fixed ID.
  New scripts: build:preview, build:preview:firefox, sync:api-types,
  test:e2e:live. identity is a required permission (no warning).
- Contract: docs/sync-api.openapi.yaml vendored from the byte.vet webapp,
  client types generated from it, with a drift test.
- Fixes: deleting the active profile now falls back to Direct; profile
  writes are serialized across extension contexts.
- Tests: unit tests for every sync module, two-device engine tests against
  a fake byte.vet, Chromium e2e for sign-in, push/pull, alarms, restarts,
  local-only and restore, a Firefox smoke test, and an opt-in live smoke
  against northernlight.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

UX
- Preference page: one shared label column across sections; Import and
  Export as labeled rows; the signed-out Sync section as an Account row;
  Sign out as a text button.
- Last sync shown as relative time ("a few seconds ago", "5 minutes ago"),
  with the exact time on hover.
- Popup Config button opens Preference when no custom profile is active.
- Sync privacy note reworded: data is stored encrypted and used only to
  keep devices in sync (byte.vet holds the keys; not end-to-end).

Behavior
- A service worker wake (most page loads) no longer reaches the server
  when nothing is pending and the last sync is recent; the poll alarm
  pulls the rest.
- One cookie-free fetch for every byte.vet request (syncFetch); the fake
  byte.vet sets a session cookie and refuses cookie-bearing POSTs, so e2e
  catches a regression.
- Sync settings written under a lock; sign-out removes its keys
  (Host.remove) instead of writing null.

Simplification
- needsFirstChoice flag instead of a three-state phase; fewer state
  writes per run; one decodeRemote; pref defaults owned by their modules;
  shared identity implementation in BaseAdapter; build settings from one
  source; dead API surface removed.
- Shared unit-test fixtures (tests/helpers.ts) and e2e helpers
  (signedInStorage, popconfirmOK); the fake server uses the generated
  contract types.

Build
- build:preview:firefox writes to dist-firefox/, so it no longer replaces
  the Chrome preview in dist/.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

- Match the proxy host case-insensitively (and with or without IPv6
  brackets): Chrome reports the challenger host lower-cased, so a host
  typed with capitals never matched and Chrome prompted.
- Chrome never asks extensions for credentials on requests they can't
  see, like the new tab page's, and prompts instead. warmUpProxyAuth
  sends one request of ours through the active proxy (to
  proxyverse-auth.invalid, which never resolves) at browser start and on
  every proxy change, when the active profile tree has credentials, so
  Chrome caches them first.
- e2e: the warm-up caches credentials; host case; the retry order is now
  asserted on the warm-up request, the first one through the proxy.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…shing

- A tab's own badge wins over the global one, so a profile switch now
  repaints every open tab with the profile predicted for its page (the
  sub-profile under an auto profile). Before, switching (e.g. to System)
  left each tab showing the old profile until it loaded a page. A worker
  start leaves tab badges alone.
- The failure count no longer alternates under System or while another
  extension controls the proxy: Proxyverse isn't routing traffic then.
  Failures are still recorded, and show again once a profile is active.
- Preference > Interface: "Failed resources on the icon" switch
  (ui.failureBadge, on by default), synced through byte.vet. The server
  must accept pref:ui.failureBadge before this ships; vendored contract
  updated.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

060930f adds Preference > Interface > "Failed resources on the icon", a
switch to turn off the failed-resources count on the toolbar badge.

Closes #72

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>