feat(ext/sw): org config storage + org_list_configs message

Introduces OrgConfig/OrgConfigSummary types, chrome.storage.local backing
via org-config.ts, and the first org SW message (org_list_configs) wired in
all three required places: PopupMessage union, POPUP_ONLY_TYPES set, and a
case arm in popup-only.ts. Handler projects to OrgConfigSummary — apiToken,
hostUrl, repoPath, memberId never leave the SW. 3 new TDD tests (RED→GREEN).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014s527M917W47LDrfQ4t47g

extension/src/shared/messages.ts

@@ -1,7 +1,7 @@
 import type {
   Item, ItemId, Manifest, ManifestEntry, VaultConfig, SetupState,
   DeviceSettings, GeneratorRequest, VaultSettings, AttachmentRef, Device,
-  FieldHistoryView,
+  FieldHistoryView, OrgConfigSummary,
 } from './types';
 
 // --- Session timeout config ---
@@ -68,7 +68,8 @@ export type PopupMessage =
       carrierImageBytes: ArrayBuffer; deviceName: string }
   | { type: 'attach_vault'; config: VaultConfig; passphrase: string;
       referenceImageBytes: ArrayBuffer; deviceName: string }
-  | { type: 'get_vault_status' };
+  | { type: 'get_vault_status' }
+  | { type: 'org_list_configs' };
 
 // --- Messages a content script may send ---
 
@@ -182,6 +183,7 @@ export const POPUP_ONLY_TYPES: ReadonlySet<PopupMessage['type']> = new Set([
   'preview_totp_from_secret',
   'generate_recovery_qr', 'unwrap_recovery_qr',
   'create_vault', 'attach_vault', 'get_vault_status',
+  'org_list_configs',
 ] as PopupMessage['type'][]);
 
 export interface ExportBackupResponse extends Extract<Response, { ok: true }> {
@@ -221,6 +223,10 @@ export interface GetVaultStatusResponse extends Extract<Response, { ok: true }>
           pendingItems: number };
 }
 
+export interface OrgListConfigsResponse extends Extract<Response, { ok: true }> {
+  data: OrgConfigSummary[];
+}
+
 export const CONTENT_CALLABLE_TYPES: ReadonlySet<ContentMessage['type']> = new Set([
   'get_autofill_candidates', 'get_credentials', 'check_credential', 'blacklist_site',
   'capture_save_login',