ext: popup, options, and the panel bridge (build order step 6)

Popup and Options are separate documents from the background page and
can't reach its live VeloxTransport directly, so background/bridge.ts
relays it over one browser.runtime.connect port per document
(call/subscribe/getStatus/reconnect/pair/unpair/setOverride in;
result/event/status/pairError out). shared/panel-client.ts is the
client side both surfaces use.

Popup (src/popup/): status dot + text, active-downloads list driven by
event.task.progress/added/state/removed (repaints ride the event's own
<=4 Hz cap rather than adding a second timer), pause/resume buttons,
"Start it" wired to a reconnect request. State lives in a DOM-free
store.ts for unit testing; rendering uses createElement, not innerHTML
(web-ext lint flags the latter).

Options (src/options/): transport override select, pairing (code entry
+ pair/unpair, backed by two new WebSocketTransport methods,
pairWithCode/unpair), and the daemon's capture policy mirrored via
capture.getRules. The capture-policy form is editable only when the
active transport is native messaging (uds) -- settings.set and
rules.upsert are privileged, uds-only methods per shared/protocol
METHODS, so WebSocket can't write them no matter what the page shows;
CLAUDE.md section 2 rules out working around that locally. The bridge's
status payload adds a kind field (which transport is live) for this to
key off. Default category is the one piece of state that's genuinely
the extension's own, not the daemon's, and lives in
browser.storage.local via options/prefs.ts. Pure decisions (statusLine,
pairingAvailable, captureRulesEditable) are split into view.ts for unit
testing without a DOM.

manifest.json registers the popup action and options_ui page (and, in
the same edit, the content_scripts entry the next commit's media
detection needs -- split by file, not by manifest line). build.mjs
gains popup/options as further esbuild entry points, plus copying their
static HTML/CSS into dist/.

Co-Authored-By: Claude Sonnet 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Ed8KEmAW48v4YHdxLtqsMB

extension/src/options/prefs.ts

@@ -0,0 +1,25 @@
+// Extension-local preferences: state that belongs to this browser install, not to the
+// daemon's Settings bag. The protocol draws a hard line here — settings.set and
+// rules.upsert are privileged, uds-only methods (METHODS in shared/protocol) — so an
+// Options page reachable only over the WebSocket transport cannot write the daemon's
+// capture policy no matter what the UI looks like. Rather than inventing a protocol
+// field to work around that (CLAUDE.md §2 forbids exactly this), the extension:
+//   - mirrors the daemon's capture policy read-only via capture.getRules (works on
+//     both transports, and is what shouldCapture() itself already trusts), and
+//   - keeps the one piece of "options" state that genuinely is the extension's own —
+//     which category new captures/context-menu downloads default to — in
+//     browser.storage.local, exactly like the pairing token and transport override.
+// Editing the mirrored capture policy is only offered when connected via NativeTransport,
+// where settings.set is allowed; see options.ts.
+
+const KEY = { defaultCategoryId: 'velox.defaultCategoryId' } as const;
+
+export async function getDefaultCategoryId(): Promise<string | null> {
+  const bag = await browser.storage.local.get(KEY.defaultCategoryId);
+  return (bag[KEY.defaultCategoryId] as string | undefined) ?? null;
+}
+
+export async function setDefaultCategoryId(categoryId: string | null): Promise<void> {
+  if (categoryId === null) await browser.storage.local.remove(KEY.defaultCategoryId);
+  else await browser.storage.local.set({ [KEY.defaultCategoryId]: categoryId });
+}