Add Dispatch browser feedback extension

[selfcontained]

Summary

• add a Chrome side-panel extension for selecting DOM elements and sending comments plus framework-agnostic page context to a chosen Dispatch agent
• add authenticated browser pairing with verification codes, multiple concurrent browser connections, scoped bearer tokens, token cleanup, and idempotent feedback delivery
• add a contextual Settings > Connections experience for downloading the extension ZIP, approving pairing requests, and managing paired browsers
• package the extension into Dispatch runtime assets so binary-release instances can serve the ZIP
• support page selection across websites with explicit Chrome host-permission handling and clear HTTP transport disclosure

Security and privacy

• pairing requires a matching short verification code and explicit Dispatch approval
• remote redirects are rejected by extension requests
• tokens are scoped, revocable, encrypted at rest, and cleaned up after expiry/revocation
• duplicate delivery is prevented with a client submission UUID
• cross-origin frame inspection is limited to origins the user grants the extension permission to access
• detailed delivery errors remain server-side

Validation

• pnpm run check
• pnpm run finalize:web
• pnpm run test
• bash scripts/e2e-isolated.sh --workers=2 — 168 passed, 13 skipped
• fresh database migration through 0035_browser-extension.sql
• extension ZIP served successfully from a fresh dev stack

Reviews

• architecture review: approved after round 2
• frontend UX review: approved after round 2
• backend security review: approved after round 2