feat: browser bridge command palette

[WangEn]

What changed

• add a Web ↔ extension Browser Bridge using window.postMessage + extension runtime messaging
• dynamically register the bridge content script only for the explicitly authorized Dockmark origin
• inject the bridge into already-open Dockmark tabs after connection
• surface live open browser tabs as highest-priority Command Palette results
• activate an existing tab directly from the Launcher
• refresh open-tab results when tabs are created, removed, activated, renamed, repinned or navigated
• make Workspace reuse focus an existing matching URL before opening another tab
• make Workspace pinned reuse/pin an existing tab or create a pinned tab
• preserve Session pinned state when restoring from the Web Launcher through the extension
• keep a Web-only fallback when the extension is absent or disconnects
• remove the previously authorized Dockmark host permission when the configured self-hosted origin changes
• document Browser Bridge roadmap completion

Security / permissions

The extension does not ship a <all_urls> content script. It requests host access only when the user connects a Dockmark origin, then uses the scripting API to register dockmark-bridge.js for that exact origin. Web bridge requests are accepted only when the runtime sender tab belongs to the configured Dockmark origin.

Command priority

Open Tabs > Workspace > Session > Bookmark > Navigation > Search

Validation

CI runs Node 22 install, TypeScript checks and both Web + Extension builds.