feat(ext/sw): attach_vault handler (Plan C Phase 3)

Same shape as create_vault: the SW owns the attach flow end to end -- fetch
salt/params/manifest from the remote, unlock with the user's reference image,
manifest_decrypt to verify the passphrase+image, register this device, persist
config + reference image, and transition the SW to the unlocked state. On
failure the handle is locked then freed; ownership transfers to the session
only on success.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

extension/src/service-worker/router/popup-only.ts

@@ -631,7 +631,10 @@ export async function handle(
     case 'create_vault':
       return vault.handleCreateVault(msg, state);
 
-    // attach_vault lands in Task 3.3; get_vault_status in Phase 6 (Dev-C).
+    case 'attach_vault':
+      return vault.handleAttachVault(msg, state);
+
+    // get_vault_status lands in Phase 6 (Dev-C).
     // Until each case lands, an unhandled popup message returns an explicit
     // error rather than falling through with no return.
     default: