feat: bootstrap Dewee Chrome side panel extension

[mrgoonie]

Summary

Bootstraps the Dewee Chrome MV3 side panel described in #1.

• Stack: TypeScript, React 19, WXT, pnpm, Zod, DOMPurify, Vitest, Playwright and ESLint, with a strict extension CSP and no remote code.
• Modes: one typed DeweeClient serves both.
  • Cloud uses OAuth PKCE (S256) through the CCP BFF.
  • Self-hosted uses a Gateway URL plus a personal scoped API key (operator.read/operator.write). The master token is never accepted.
  • Host permission is requested per gateway origin at runtime.
• Chat:
  • Workspace and agent pickers, with Super Agent pinned first.
  • Streaming over SSE, sessions and history, Stop.
  • Reconcile after a failure, with no automatic resend. "Send again" appears only when the server provably did not receive the turn; otherwise the turn is shown once as "Delivery could not be confirmed" with a reload action.
• Credential cards:
  • secret_request and oauth_request render from a fixed list of kinds validated with Zod.
  • Secret values live only in the form's local state and go only to POST …/actions/{id}/respond, never into chat, storage, logs or app state.
  • Card continuations are queued by action id, storing IDs only in chrome.storage.session. They leave the queue only on proof of delivery (message.completed, 409 continuation_sent, setup_result_delivered) or a permanent refusal. continuation_in_progress is retried with bounded backoff, and other failures are held with "Continue".
• Badge, vi/en, light/dark themes and a11y, including focus management and live regions.
• CI: lint, typecheck, unit and integration tests, build, and e2e smoke. The release workflow packages the sideload zip (pinned key) and the store zip (no key).
• Docs: docs/architecture.md, api-contract.md, auth-threat-model.md, credential-threat-model.md and development.md, plus AGENTS.md with the label and review workflow.

Backend dependencies (nextlevelbuilder/dewee, all targeting dev)

PR	What the panel needs from it
nextlevelbuilder/dewee#1021	Closes #991, #1001
nextlevelbuilder/dewee#1022	/v1/extension/* for personal API keys, 409 details, continuation_in_progress vs continuation_sent (Closes #956, #1036, #1047; stacked on #1021)
nextlevelbuilder/dewee#1019	credential.request capability and the policy revoke reason (Closes #958, #1035)
nextlevelbuilder/dewee#1045	First-turn session visible during the run; a stopped turn is kept, with an injected stop marker (Closes #1033, #1034)
nextlevelbuilder/dewee#1014, nextlevelbuilder/dewee#1015	#957, #992 (#1015 stacked on #1014)
nextlevelbuilder/dewee#1010, nextlevelbuilder/dewee#1011, nextlevelbuilder/dewee#1044	#1000, #993, #1037
nextlevelbuilder/dewee#1028, nextlevelbuilder/dewee#1031, nextlevelbuilder/dewee#1040	#1008, #1029, #1032 (a stack on top of #1021)

Docs counterpart: nextlevelbuilder/dewee-web-v2#14.

These changes still need fixing when the Dewee PRs are merged for real:

• regenerate spec.hash.lock (#1019 against #1022);
• union provisioning_chat_abort.go;
• keep both fields in loop_types.go;
• add AbortRun to the recordingChatAborter test fake.

Evidence

• pnpm lint, pnpm typecheck, pnpm test (27 files, 376 tests), pnpm build and pnpm zip:store pass.
• pnpm test:e2e in CI mode (no live keys): 5 smoke tests pass and 16 live tests are skipped.
• Live e2e: 21/21 passed twice with the final code, against a local combined stack (dewee#1022 at b18b35c9 + #1019 + #1010 + #1015 + #1045). That covers scenarios A (Cloud), B (self-hosted), C (credentials), D (an agent without setup, policy revoked) and E (resilience). See plans/reports/tester-261012-0930-live-e2e-final2.md and the screenshots in plans/reports/assets/live-e2e/.
• Isolated code reviews ran after each fix round, and their findings were fixed with mutation-checked tests. The reports are in plans/reports/code-reviewer-*.md.
• A scan of the committed files found no secrets.

Not covered by a live test

• The continuation_refused and held ("Continue") paths have unit tests only.
• One unreproduced 59.5 s pass of "E lost respond", seen in an earlier run.

Follow-ups

• security: cap the SSE reader line buffer #2: cap the SSE line buffer.

Closes #1

🤖 Generated with Claude Code