feat(extension): in-app update prompt — popup banner + toolbar badge (#1489)

The extension is installed per-instance from the operator's FC host, so Firefox's
static update_url can't apply (each instance has a different host) and updates
were fully manual. Add a self-hosted-friendly update surface that reuses the
existing public GET /api/extension/manifest ({version, latest_url, sha256}):

- lib/api.js: getExtensionManifest().
- background.js: checkForUpdateInfo() compares the instance's latest published
  version against runtime.getManifest().version (dotted-numeric compare so
  1.0.10 > 1.0.9); CHECK_UPDATE message handler; refreshUpdateBadge() sets a
  toolbar badge via browser.action; a daily browser.alarms check plus on
  startup/installed. New 'alarms' permission (non-prompting).
- popup: an 'Update available — vX' banner with an Update button that opens the
  signed XPI (web root, /api stripped like OPEN_ARTIST_PAGE) → Firefox's native
  install prompt. Never blocks the popup on a failed check.

No backend changes (endpoint already exists). Bump 1.0.8→1.0.9 so this ships;
from here on updates surface themselves instead of needing a manual reinstall.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

extension/background/background.js

@@ -31,6 +31,69 @@ browser.runtime.onInstalled.addListener(() => ensureInitialized());
 browser.runtime.onStartup.addListener(() => ensureInitialized());
 ensureInitialized().catch(e => console.error('init failed:', e));
 
+// ---- Extension self-update check (#1489) ----
+// Installed per-instance from the operator's FC host, so Firefox's static
+// update_url can't apply (each instance has a different host). Instead ask the
+// configured backend for the latest published version and nudge the operator to
+// reinstall the freshly-signed XPI — surfaced as a popup banner (on demand) and
+// a toolbar badge (daily). /api/extension/manifest is public and returns
+// {version, latest_url, sha256}; the XPI is served from the web root (not /api).
+
+function versionIsNewer(candidate, current) {
+  // Dotted numeric compare so 1.0.10 > 1.0.9 (a plain string compare wouldn't).
+  const a = String(candidate).split('.').map(n => parseInt(n, 10) || 0);
+  const b = String(current).split('.').map(n => parseInt(n, 10) || 0);
+  for (let i = 0; i < Math.max(a.length, b.length); i++) {
+    if ((a[i] || 0) !== (b[i] || 0)) return (a[i] || 0) > (b[i] || 0);
+  }
+  return false;
+}
+
+async function checkForUpdateInfo() {
+  await ensureInitialized();
+  if (!api.isConfigured()) return { updateAvailable: false, configured: false };
+  let info;
+  try {
+    info = await api.getExtensionManifest();
+  } catch (e) {
+    return { updateAvailable: false, error: e.message };
+  }
+  const currentVersion = browser.runtime.getManifest().version;
+  const latestVersion = info && info.version ? info.version : null;
+  // latest_url is served from the web root; strip the /api suffix off baseUrl
+  // (same transform as OPEN_ARTIST_PAGE).
+  const base = (api.baseUrl || '').replace(/\/+$/, '').replace(/\/api$/, '');
+  return {
+    updateAvailable: !!latestVersion && versionIsNewer(latestVersion, currentVersion),
+    currentVersion,
+    latestVersion,
+    xpiUrl: info && info.latest_url ? `${base}${info.latest_url}` : null,
+  };
+}
+
+async function refreshUpdateBadge() {
+  let r;
+  try { r = await checkForUpdateInfo(); } catch { return; }
+  try {
+    await browser.action.setBadgeText({ text: r.updateAvailable ? '↑' : '' });
+    if (r.updateAvailable) {
+      await browser.action.setBadgeBackgroundColor({ color: '#F4BA7A' });
+      await browser.action.setTitle({ title: `FabledCurator — update available (v${r.latestVersion})` });
+    } else {
+      await browser.action.setTitle({ title: 'FabledCurator' });
+    }
+  } catch { /* action API unavailable — non-fatal */ }
+}
+
+// Daily proactive check (needs the "alarms" permission). create() is idempotent
+// by name, so re-running it on each event-page load is safe.
+browser.alarms.create('fc-update-check', { periodInMinutes: 24 * 60, delayInMinutes: 1 });
+browser.alarms.onAlarm.addListener((alarm) => {
+  if (alarm.name === 'fc-update-check') refreshUpdateBadge();
+});
+browser.runtime.onStartup.addListener(() => refreshUpdateBadge());
+browser.runtime.onInstalled.addListener(() => refreshUpdateBadge());
+
 // ---- Discord token capture via webRequest ----
 
 browser.webRequest.onBeforeSendHeaders.addListener(
@@ -298,6 +361,9 @@ browser.runtime.onMessage.addListener(async (msg) => {
       }
     }
 
+    case 'CHECK_UPDATE':
+      return await checkForUpdateInfo();
+
     default:
       return { error: `Unknown message type: ${msg.type}` };
   }