fix: extension updates install the new build — no 12h-cached "latest" XPI, and the popup's Update opens FC's install page

Operator, 2026-09-25: "the extension update trigger from inside the
extension doesn't work and the manual update seems to not move it to the
most recent version or at least mark it the most recent."

- fabledcurator-latest.xpi was served with Quart's default
  `public, max-age=43200`: one URL whose bytes change every release, so a
  browser that had fetched it reinstalled the previous build for 12 hours
  (measured on the instance). It is now `no-cache` (the ETag keeps an
  unchanged file a 304); versioned XPIs are `immutable`.
- The web Settings card installs/downloads the VERSIONED xpi_url, which can
  only ever be that build's bytes.
- The popup's Update button did tabs.create() on the .xpi, which Firefox
  refuses (NS_ERROR_FAILURE on a 200: it only installs from a user click on
  a web page). It now opens FC's install card (/subscriptions?tab=settings).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LVjrnpQjRgHdvq95rASoiR

frontend/src/components/settings/BrowserExtensionCard.vue

@@ -49,16 +49,20 @@
                sometimes triggered nothing instead of the install dialog
                (operator-flagged 2026-05-26). No `download` attribute —
                that would force a save dialog instead of install. -->
+          <!-- The VERSIONED file, not the `latest` alias: a versioned URL can
+               only ever be this build's bytes, so a browser cache can't hand
+               back the previous build (operator-flagged 2026-09-25: a cached
+               alias reinstalled the old version and the update never took). -->
           <v-btn
             v-if="isFirefox"
             color="accent" variant="flat" rounded="pill"
             prepend-icon="mdi-firefox"
-            :href="manifest.latest_url"
+            :href="manifest.xpi_url"
           >Install Firefox extension</v-btn>
 
           <v-btn
             variant="outlined" rounded="pill"
-            :href="manifest.latest_url" download
+            :href="manifest.xpi_url" download
             prepend-icon="mdi-download"
           >Download XPI</v-btn>