harden: list and end site connections made without Remember in Settings (closes #406)

A site allowed without "Remember" lives only in the background's
in-memory connectedSites map. Settings never listed it, and
AUTISTMASK_REMOVE_SITE, sent on every remove, did nothing, so the user
could not end such a connection.

Settings now asks the background for those sites and lists them under
Connected Sites. Removing a site from Allowed Sites or Connected Sites
drops its remembered entry under every address and sends
AUTISTMASK_REMOVE_SITE with the hostname; the background deletes every
matching connectedSites entry and sends accountsChanged with an empty
list to the site's tabs. Only the extension's own pages may send either
message.

Model: opus-5-5

src/popup/index.html

@@ -1064,6 +1064,15 @@
                     <div id="settings-allowed-sites"></div>
                 </div>
 
+                <div class="bg-well p-3 mx-1 mb-3">
+                    <h3 class="font-bold mb-1">Connected Sites</h3>
+                    <p class="text-xs text-muted mb-2">
+                        Sites you allowed without "Remember my choice".
+                        Switching address disconnects them.
+                    </p>
+                    <div id="settings-connected-sites"></div>
+                </div>
+
                 <div class="bg-well p-3 mx-1 mb-3">
                     <h3 class="font-bold mb-1">Denied Sites</h3>
                     <p class="text-xs text-muted mb-2">