Add Wafir Issue Reporter Chrome Extension + patch Vite CVEs

[Copilot]

Testers had no way to use Wafir without the dev team embedding the widget in their app and installing the Bridge as a GitHub App. This adds a standalone Chrome extension that injects the widget into any page, submitting issues directly via a GitHub PAT — no Bridge installation required.

New package: apps/chrome-extension

Architecture (Manifest V3):

• Content script (injector.ts) — IIFE; injects the Wafir IIFE bundle + bridge script into every page
• Main-world bridge (main-world.ts) — IIFE injected into page context; intercepts fetch calls to the synthetic origin https://wafir-extension.invalid using an exact origin comparison (not startsWith) and routes them through Chrome messaging to the service worker
• Service worker — handles config loading (YAML/JSON parsed via js-yaml), GitHub issue creation via REST API using the stored PAT, and ImgBB screenshot uploads (5-min expiry)
• Options page — configure GitHub PAT, config file URL (any publicly accessible HTTPS YAML/JSON), and ImgBB API key; includes a "Test Connection" button

Screenshot privacy warning is injected as a CSS ::after on <wafir-widget> so it appears persistently near the widget button on every page, and is also prominently shown in the options UI.

Build: three Vite passes — vite build (options page + service worker as ESM), vite build --mode injector, vite build --mode main-world (both as self-contained IIFEs, required because manifest-declared content scripts run as classic scripts).

The wafir package itself is unchanged; the extension copies its pre-built IIFE from node_modules/wafir/dist/iife/wafir.js at build time.

Security: Vite CVE fixes

Upgraded Vite 7.2.4 → 7.3.2 across all packages to address:

• server.fs.deny bypass (GHSA, affects 7.1.0–7.3.1)
• Arbitrary file read via dev server WebSocket (affects 7.0.0–7.3.1)

Also added vite: "^7.3.2" explicitly to apps/bridge devDependencies so vitest's peer resolution no longer pins the old version — vite@7.2.4 is fully removed from the lockfile.