feat(extension): auto-intercept https→pap, unit tests, refactor

[toadkicker]

Summary

• Auto-intercept: Content script now intercepts all `https://` left-clicks and routes them through the PAP handshake automatically. Alt+click opts out per-click; global toggle and per-domain exclusion list in popup.
• Unit tests: 117 tests across 4 files (`uri.test.ts`, `discovery.test.ts`, `intercept-logic.test.ts`, `db.test.ts`). Added `intercept-logic.ts` as a pure-function extraction to keep content-script testable in Node.
• Refactor: Eliminated all cross-file constant duplication and magic values — new `constants.ts` for storage keys, exported `NATIVE_APP_ID` from `native-messaging.ts`, named limits in `discovery.ts` with `isValidString()` helper, named badge colors and context-menu ID in `service-worker.ts`, `$()` DOM helper in `popup.ts`.

Test plan

• CI: `just extension` Vite build passes
• CI: `cargo test --workspace` passes
• CI: `cargo clippy` / `cargo fmt` pass
• CI: CodeQL / audit checks pass
• All 117 extension unit tests pass (`npx vitest run` in `apps/papillon-extension/`)

🤖 Generated with Claude Code

[github-actions]

Benchmark Regression Report

PAP Protocol Benchmark Regression Check
========================================
Baseline: .bench-baseline/baseline.json
Threshold: 30%

  ed25519_keypair_generation                19.8 µs  (baseline: 19.7 µs, +0.5%)  [ok]
  did_key_derivation                         1.5 µs  (baseline: 1.5 µs, +0.2%)  [ok]
  mandate_create_sign                       23.9 µs  (baseline: 23.9 µs, +0.0%)  [ok]
  mandate_chain_verify_depth3              127.0 µs  (baseline: 126.9 µs, +0.0%)  [ok]
  sd_jwt_issue_5claims                      28.0 µs  (baseline: 27.9 µs, +0.4%)  [ok]
  sd_jwt_verify_disclose_3of5               43.4 µs  (baseline: 44.3 µs, -1.9%)  [ok]
  session_open_full_lifecycle              109.4 µs  (baseline: 108.7 µs, +0.6%)  [ok]
  receipt_create_cosign                     48.1 µs  (baseline: 48.9 µs, -1.5%)  [ok]
  federation_announce_local                 56.4 µs  (baseline: 56.0 µs, +0.6%)  [ok]

All benchmarks within 30% of baseline.

_{Threshold: 10% regression vs baseline from main}