fix: extension updates install the new build — no 12h-cached "latest" XPI, and the popup's Update opens FC's install page

Operator, 2026-09-25: "the extension update trigger from inside the
extension doesn't work and the manual update seems to not move it to the
most recent version or at least mark it the most recent."

- fabledcurator-latest.xpi was served with Quart's default
  `public, max-age=43200`: one URL whose bytes change every release, so a
  browser that had fetched it reinstalled the previous build for 12 hours
  (measured on the instance). It is now `no-cache` (the ETag keeps an
  unchanged file a 304); versioned XPIs are `immutable`.
- The web Settings card installs/downloads the VERSIONED xpi_url, which can
  only ever be that build's bytes.
- The popup's Update button did tabs.create() on the .xpi, which Firefox
  refuses (NS_ERROR_FAILURE on a 200: it only installs from a user click on
  a web page). It now opens FC's install card (/subscriptions?tab=settings).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LVjrnpQjRgHdvq95rASoiR

extension/popup/popup.js

@@ -76,7 +76,7 @@ function updateConnectionDot(connected) {
 async function checkForUpdate() {
   try {
     const r = await browser.runtime.sendMessage({ type: 'CHECK_UPDATE' });
-    if (r && r.updateAvailable && r.xpiUrl) showUpdateBanner(r);
+    if (r && r.updateAvailable && r.installPageUrl) showUpdateBanner(r);
   } catch { /* non-fatal */ }
 }
 
@@ -86,10 +86,14 @@ function showUpdateBanner(r) {
   // exactly as it did before the field existed.
   const channel = r.channel ? ` (${r.channel})` : '';
   document.getElementById('update-text').textContent =
-    `Update available${channel} — v${r.latestVersion} (installed v${r.currentVersion})`;
-  // Opening the signed XPI triggers Firefox's native install prompt.
+    `Update available${channel} — v${r.latestVersion} (installed v${r.currentVersion}). ` +
+    'Opens FabledCurator — click “Install Firefox extension” there.';
+  // Opens FC's install card rather than the XPI: Firefox only installs an
+  // add-on from a user click on a web page, never from a tab an extension
+  // opened on the .xpi itself.
   document.getElementById('update-btn').addEventListener('click', () => {
-    browser.tabs.create({ url: r.xpiUrl });
+    browser.tabs.create({ url: r.installPageUrl });
+    window.close();
   });
   document.getElementById('update-banner').classList.remove('hidden');
 }