feat(ext/content): closed Shadow DOM for icon/picker/TOFU + close fill TOCTOU

Two security fixes bundled together because they all live on the
icon-click/fill path:

1. Icon + picker + TOFU hint now render inside closed-mode Shadow DOM
   (via shadow.createShadowHost). Page scripts can no longer find our
   overlay via document.querySelector or rewrite buttons.

2. Icon's get_autofill_candidates call drops the `url` field — router
   derives origin from sender.tab.url. Similarly get_credentials.

3. Icon's get_credentials response handling was buggy: the response is a
   discriminated union { requires_ack, hostname } | { username, password }
   and the old code always read .username (→ undefined when requires_ack).
   New code dispatches on the `requires_ack` marker and either shows an
   in-page TOFU hint or fills directly.

4. fill_credentials is popup-only in the router — the icon click cannot
   (and MUST NOT) issue it from content. The new flow calls fillFields()
   directly after get_credentials returns the plaintext: the content
   script IS the origin, so no SW round-trip is needed for the typing.

5. TOCTOU on the popup → SW → content fill path: the SW verified the
   captured tab's hostname matched capturedUrl, then forwarded blindly.
   Between that check and chrome.tabs.sendMessage delivery, the tab can
   navigate; chrome.tabs.sendMessage delivers to whatever content-script
   principal is loaded at send-time. Closed by:
   - Router forwards { expectedHost: currentHost } in the payload.
   - fill.ts re-checks location.href.hostname === expectedHost before
     typing anything; on mismatch replies { ok: false, error: 'origin_changed' }
     and types nothing.

6. Remove @ts-nocheck from icon.ts, fill.ts, and detector.ts — all three
   now type-check clean.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

extension/src/service-worker/router/popup-only.ts

@@ -199,10 +199,15 @@ async function handleFillCredentials(
   const itemHost = safeHostname(item.core.url ?? '');
   if (!itemHost || itemHost !== currentHost) return { ok: false, error: 'origin_mismatch' };
 
+  // Pass the hostname the SW validated. The content script re-verifies
+  // against location.href before filling — if the tab navigated between
+  // our chrome.tabs.get check above and the sendMessage delivery below,
+  // fill.ts rejects with 'origin_changed'.
   await chrome.tabs.sendMessage(msg.capturedTabId, {
     type: 'fill_credentials',
     username: item.core.username ?? '',
     password: item.core.password ?? '',
+    expectedHost: currentHost,
   });
   return { ok: true };
 }