fix: a site allowed without Remember stays connected when the background worker idles (closes #526)

A connection allowed without "Remember my choice for this site" was held
in a module-level object in the background worker. Chrome stops the worker
after about 30 seconds idle, so the connection ended at the first idle
spell. Each such connection is now one item in the browser's session
storage, which outlives the worker but not the browser, read and written
through new wrappers in src/shared/browserApi.js. Settings now waits for
the background to end a removed site's connections before listing the
connected sites again. The Firefox manifest declares 115.0, the first
version with session storage, as its minimum.

Model: opus-5-5

src/popup/views/settings.js

@@ -76,11 +76,13 @@ function forgetOrigin(siteMap, origin) {
 
 // Removing a site from Allowed Sites or Connected Sites disconnects it: it is
 // no longer allowed under any address, and the background ends its
-// connections approved without "Remember" and tells its open tabs.
+// connections approved without "Remember" and tells its open tabs. The
+// background answers once those have ended, so the lists drawn after it no
+// longer show the site.
 async function removeAllowedSite(origin) {
     forgetOrigin(state.allowedSites, origin);
     await saveState();
-    notify({ type: "AUTISTMASK_REMOVE_SITE", origin });
+    await sendMessage({ type: "AUTISTMASK_REMOVE_SITE", origin });
     await renderSiteLists();
 }
 
@@ -230,8 +232,8 @@ async function renderSiteLists() {
         Object.values(state.deniedSites).flat(),
         removeDeniedSite,
     );
-    // Sites allowed without "Remember" are held only by the background, in
-    // memory, so it is asked for them.
+    // Sites allowed without "Remember" are held only in session storage, which
+    // the background keeps, so it is asked for them.
     renderSiteList(
         "settings-connected-sites",
         await sendMessage({ type: "AUTISTMASK_GET_CONNECTED_SITES" }),