fix: extension updates install the new build — no 12h-cached "latest" XPI, and the popup's Update opens FC's install page

Operator, 2026-09-25: "the extension update trigger from inside the
extension doesn't work and the manual update seems to not move it to the
most recent version or at least mark it the most recent."

- fabledcurator-latest.xpi was served with Quart's default
  `public, max-age=43200`: one URL whose bytes change every release, so a
  browser that had fetched it reinstalled the previous build for 12 hours
  (measured on the instance). It is now `no-cache` (the ETag keeps an
  unchanged file a 304); versioned XPIs are `immutable`.
- The web Settings card installs/downloads the VERSIONED xpi_url, which can
  only ever be that build's bytes.
- The popup's Update button did tabs.create() on the .xpi, which Firefox
  refuses (NS_ERROR_FAILURE on a 200: it only installs from a user click on
  a web page). It now opens FC's install card (/subscriptions?tab=settings).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LVjrnpQjRgHdvq95rASoiR

extension/background/background.js

@@ -88,7 +88,12 @@ async function checkForUpdateInfo() {
     currentVersion,
     latestVersion,
     channel,
-    xpiUrl: info && info.latest_url ? `${base}${info.latest_url}` : null,
+    // Where the Update button sends the operator: FC's own install card, not
+    // the XPI. Firefox refuses an add-on install whose navigation an extension
+    // started (tabs.create on the .xpi dies with NS_ERROR_FAILURE — operator-
+    // flagged 2026-09-25); it accepts one from a user click on a web page,
+    // which is exactly what the card's Install button is.
+    installPageUrl: base ? `${base}/subscriptions?tab=settings` : null,
   };
 }