feat(ext/sw): add session inactivity timer with configurable timeout

Implements a service-worker-side session timer that locks the vault
after a configurable period of inactivity (default 15 min). Supports
two modes: 'inactivity' (timer-based) and 'every_time' (no timer).
Config persists via chrome.storage.local and is exposed through
get_session_config / update_session_config popup messages.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

extension/src/service-worker/index.ts

@@ -2,9 +2,12 @@
 /// forwards every message into router/index.route().
 
 import type { Request, Response } from '../shared/messages';
+import type { SessionTimeoutConfig } from '../shared/messages';
 import type { RouterState } from './router/index';
 import { route } from './router/index';
 import * as vault from './vault';
+import { clearCurrent } from './session';
+import * as sessionTimer from './session-timer';
 
 // @ts-ignore TS2307 — resolved by webpack alias / copy
 import initDefault, { initSync } from '../../wasm/relicario_wasm.js';
@@ -43,9 +46,28 @@ const state: RouterState = {
   wasm: null,
 };
 
+// --- Session timer wiring ---
+
+sessionTimer.onExpired(() => {
+  // eslint-disable-next-line no-console
+  console.log('[relicario sw] session expired — locking vault');
+  clearCurrent();
+  state.manifest = null;
+  // Best-effort broadcast — receiver may not exist yet.
+  chrome.runtime.sendMessage({ type: 'session_expired' }).catch(() => {});
+});
+
+// Restore saved session config from chrome.storage.local on SW startup.
+chrome.storage.local.get('sessionTimeoutConfig').then((r) => {
+  if (r.sessionTimeoutConfig) {
+    sessionTimer.setConfig(r.sessionTimeoutConfig as SessionTimeoutConfig);
+  }
+}).catch(() => {});
+
 chrome.runtime.onMessage.addListener(
   (request: Request, sender: chrome.runtime.MessageSender, sendResponse: (r: Response) => void) => {
     (async () => {
+      sessionTimer.resetTimer();
       if (!state.wasm) {
         // eslint-disable-next-line no-console
         console.log('[relicario sw] initializing WASM on first message');