feat(ext): verify cookies in-browser before uploading (1.0.7)

Pre-upload verify request: after capturing the live browser cookies,
hit a known authenticated endpoint with credentials:'include' from the
extension's background context. If the platform reports we're not
logged in, abort the upload so we don't overwrite FC-side credentials
with stale data.

- platforms.js: add `verify` config per cookie-auth platform
  - hentaifoundry: HEAD /?enterAgree=1 (mirrors gallery-dl's HF
    _init_site_filters; same 401 path the operator hit 2026-06-03)
  - patreon: GET /api/current_user (clean 401 when logged out)
  - subscribestar, deviantart: no stable auth endpoint, skip verify
- cookies.js: verifyCookiesForPlatform() returns {ok, status, reason}.
  ok=true/false/null tri-state — null = verify not configured, caller
  treats as "proceed".
- background.js EXPORT_COOKIES + EXPORT_ALL_COOKIES: verify gates the
  upload; failures bubble up with the platform's name + reason.
- popup.js: success message now appends "(verified ✓)" when applicable.
- manifest + package.json: 1.0.6 → 1.0.7.

extension/background/background.js

@@ -194,9 +194,20 @@ browser.runtime.onMessage.addListener(async (msg) => {
         if (platform.authType === 'cookies') {
           const cookies = await extractCookiesForPlatform(key);
           if (cookies.length === 0) return { error: 'No cookies found — log in first.' };
+          // Verify the captured cookies are actually live BEFORE
+          // uploading. Skips upload on confirmed-stale sessions so we
+          // don't overwrite FC-side credentials with garbage. Platforms
+          // without a verify config (verify.ok === null) fall through
+          // to upload as before.
+          const v = await verifyCookiesForPlatform(key);
+          if (v.ok === false) {
+            return {
+              error: `Captured ${cookies.length} ${platform.name} cookies but they don't appear authenticated (${v.reason}). Log in again in this browser, then retry.`,
+            };
+          }
           const data = toNetscapeFormat(cookies);
           await api.uploadCredentials(key, 'cookies', data);
-          return { success: true, cookieCount: cookies.length };
+          return { success: true, cookieCount: cookies.length, verified: v.ok === true };
         }
         if (key === 'discord') {
           if (!discordToken) return { error: 'Open discord.com to capture a token first.' };
@@ -229,8 +240,13 @@ browser.runtime.onMessage.addListener(async (msg) => {
             results[key] = { skipped: true, reason: 'no cookies' };
             continue;
           }
+          const v = await verifyCookiesForPlatform(key);
+          if (v.ok === false) {
+            results[key] = { error: `verify failed: ${v.reason}` };
+            continue;
+          }
           await api.uploadCredentials(key, 'cookies', toNetscapeFormat(cookies));
-          results[key] = { success: true, cookieCount: cookies.length };
+          results[key] = { success: true, cookieCount: cookies.length, verified: v.ok === true };
         } catch (e) {
           results[key] = { error: e.message };
         }