refactor: one shared extension-API module, and drive the dApp flows on Firefox (closes #153)

Every call site that touched `browser.*` or `chrome.*` now goes through
`src/shared/browserApi.js`, the only file in the tree that names either.
It exposes lazily-resolved namespace handles for events and synchronous
methods, and promise-returning wrappers for everything that is
callback-shaped on Chrome. Callers await; `runtime.lastError` is gone,
folded into the rejection the wrapper produces on the Chrome path.

The Firefox suite gains the four dApp round trips the issue's definition
of done asks for — `eth_requestAccounts`, `personal_sign`,
`eth_sendTransaction`, and a closed approval window rejecting with
EIP-1193 4001 — driven through the real content script, background page
and approval windows. `--network none` was thought to rule that out
because it leaves no `http://` origin to inject into; loopback survives
it, so the page and a JSON-RPC node are served from 127.0.0.1 inside the
container and the run still reaches nothing but itself.

That harness refutes the premise it was built to verify. On Firefox
153.0.3, `browser.*` honours a trailing Chrome-style callback and does
populate `runtime.lastError`, both measured directly, and all four flows
pass against the unconverted code. So this is a uniformity and coverage
change, not a repair of a broken target; the PR records the measurement
in full.

One real defect is fixed on the way past: the window id written back
into a pending approval after `windows.create()` was unguarded, so an
approval settled during the open — an address switch will do it —
dereferenced a deleted entry.

TODO.md

@@ -45,6 +45,19 @@ undefined identifiers, which is how
 
 # Completed Steps
 
+- 2026-08-12: One shared extension-API module,
+  [`src/shared/browserApi.js`](src/shared/browserApi.js), is the only place in
+  the tree that names `browser` or `chrome`. Every call site returns a promise;
+  `runtime.lastError` is gone. The same commit gives the Firefox suite the four
+  dApp round trips — `eth_requestAccounts`, `personal_sign`,
+  `eth_sendTransaction` and a closed approval window rejecting with EIP-1193
+  4001 — against a page and a JSON-RPC node served from loopback, which survives
+  `--network none`. **The premise of
+  [#153](https://git.eeqj.de/sneak/AutistMask/issues/153) does not survive that
+  harness**: Firefox's `browser.*` honours a trailing Chrome-style callback and
+  populates `runtime.lastError`, both measured directly on Firefox 153.0.3, and
+  all four flows pass against the unconverted code. What landed is a uniformity
+  and coverage change, not a repair of a broken target.
 - 2026-08-12: EIP-1193 error codes now reach the page. `src/content/inpage.js`
   rebuilt every failure as `new Error(error.message)`, so the code the
   background produced and the content script relayed intact was dropped in the