Extension: request host permission dynamically instead of relying on CORS

Backend CORS is disabled by default (origin: false), and an unpacked
extension's ID isn't fixed/predictable per install anyway, so allowlisting
it server-side would be awkward. options.js now calls
chrome.permissions.request() for the entered base URL on Save — once
granted, the extension's own fetches bypass CORS entirely for that origin.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/extension-src/manifest.json

@@ -11,6 +11,8 @@
     "https://login.newbook.cloud/*"
   ],
 
+  "optional_host_permissions": ["http://*/*", "https://*/*"],
+
   "background": {
     "service_worker": "background.js"
   },