feat(extension): harden auth session handling

[oktofeesh1]

Summary

• Closes feat(extension): add secure auth and session handling #148 by hardening the browser extension auth/session boundary.

What changed

• Added a shared extension auth helper for local-only token storage, GitHub PAT rejection, legacy sync-token cleanup, expiry handling, revoked-session cleanup, and logout.
• Required extension:pull_context sessions for /v1/extension/pull-context instead of allowing full browser/static API sessions.
• Updated extension options, package assembly, OpenAPI docs, and the extension page privacy/permission copy.
• Added regression tests for local storage invariants, PAT rejection, expiry/revocation cleanup, logout clearing, and API route scope enforcement.

Why

• Extension auth is a sensitive boundary: Gittensory extension tokens should not be confused with GitHub PATs, full app sessions, or static API tokens, and stale/revoked sessions need to fail closed.

Validation

• npm run typecheck
• npm run test:unit -- test/unit/extension-auth.test.ts test/unit/openapi.test.ts
• npm run test:integration -- test/integration/api.test.ts
• npm run ui:openapi
• npm run extension:build
• npm run test:ci
• Codex Security diff scan: no reportable findings; all 13 worklist rows completed.

Notes

• The extension still supports a configurable API origin, but normalizes it to HTTPS or localhost-style development origins before using it.

[JSONbored]

@oktofeesh1 This is ready from my side. Extension auth session handling is better isolated, the browser extension no longer needs broad app credentials, and the API/OpenAPI/tests cover the scoped session path. Current checks are green and the merge tree is clean.