New UI desing to match the linkerlee.com branding.

[0.9.3] — 2026-08-20
New features:
- Unsaved tag and title work is no longer lost when the popup closes. Clicking outside an extension popup destroys it instantly, and MV3 offers no cancellable close event, so a warning at close time is not possible. Instead the popup warns while it is open - a banner and a ring on Save as soon as the form differs from what was loaded - and keeps the draft, per URL, restoring it the next next time you open the popup on that page. The draft is folded back in as a delta rather than replayed, because saving replaces the whole tag set and a stale replay would delete tags added on the platform in the meantime.

• A Remove button for a page that is already bookmarked, with an inline "Remove this bookmark?" confirmation rather than a native dialog, which an extension popup cannot show reliably. Removal is a soft delete and the status says so - the link is recoverable from your Linkerlee trash.
• The extension version in the popup footer, on both the form and the not-yet-configured screen, read from the manifest so it cannot drift from what the browser installed.
• The extension can reach a self-hosted Linkerlee. Entering another https address now asks the browser for access to that one host, and releases the previous one when it changes. Nothing is granted at install: the default configuration still talks only to linkerlee.com and prompts for nothing.

Fixes:
- The popup no longer offers a save form when nothing can be saved. It treated "configured" as "has a token", but a request is refused locally in three cases: no token, a saved address that is not a usable https host, and a host grant that was declined or later withdrawn. The popup now asks all three questions up front and names the actual problem, pointing at the options page when a grant is missing.

• The popup no longer sends the URL of a page on an internal scheme. Opening it on an about: page in Firefox, or on a file:// page in either browser, sent that URL to the tag-suggestion and bookmark-lookup endpoints - including the path of a local file. Note this means a file:// page can no longer be saved from the popup.
• A failure to reach the configured instance now says what is wrong - that the extension has not been allowed to reach that host, naming it - instead of "Failed to fetch". The saved-link badge, which runs on every tab switch with no interface of its own, logs the same rather than silently going blank.

Security:
- http:// base URLs are refused: the API token would otherwise cross the network in plain text. So are addresses carrying credentials - a URL such as https://linkerlee.com@example.invalid reads as the trusted host and resolves to another - and hostnames that are not plain DNS labels.