Persist directory subscriptions in the extension

[jt55401]

Summary

• persist weighted directory subscriptions and migrate existing settings
• keep source-based verification in the content script and expose copied per-section results to the popup
• validate runtime messages and server responses before they enter typed extension code
• replace Axios with the fetch-based JSON client and remove dead verifier, vote-control, and alarm paths
• enforce zero-warning lint and per-entry bundle budgets for Chromium, Firefox, and Safari
• pin the browser client to its reviewed commit

Dependency

Depends on HTMLTrust/htmltrust-browser-client#10

Closes #4

Validation

• npm test -- --runInBand: 92 tests in 15 suites
• npm run typecheck
• npm run lint: 0 warnings
• npm run build:all: Chromium, Firefox, and Safari pass exact bundle budgets
• production bundles: background 57,542 bytes; content 249,175; options 220,524; popup 215,495
• npm audit --audit-level=low: 0 vulnerabilities
• ./scripts/test-in-docker.sh
• git diff --check