fix: AutistMask does not work in Firefox private windows (closes #646)

Firefox gives an extension page in a private window locks of its own. A
popup there could save between the background's read and its write of the
stored record, and undo a network switch the background had saved.

manifest/firefox.json now sets "incognito": "not_allowed", so a page in a
private window cannot read or write extension storage. tests/manifest.test.js
pins the key. The README says this in "Stored state and its version". Six
code comments drop their private-window exception to the lock.
docs/README.md tells Firefox users that AutistMask does not work in private
windows.

Model: opus-5-5

src/popup/views/stateRecovery.js

@@ -143,8 +143,6 @@ async function resetProfile() {
     try {
         // Under the lock every write of the stored record takes, so the erase
         // cannot land between another write's read and its write and be undone.
-        // A page in a Firefox private window is the exception: Firefox gives
-        // it locks of its own (README, "Stored state and its version").
         await withLock("autistmask", () => storageRemove("autistmask"));
     } catch (e) {
         log.errorf("state recovery: reset failed:", e);