refactor(extension): DRY the web-root transform + cookie-export flow (#161)

Behavior-preserving (extension JS has lint-only CI + your manual test):
- api.webRoot() single-sources the baseUrl→web-root transform (strip trailing
  slash + /api) that was copy-pasted in background.js's self-update check and
  OPEN_ARTIST_PAGE, whose comments even cross-referenced each other.
- exportPlatformCookies(key) shares the extract→verify→upload spine between
  EXPORT_COOKIES (single) and EXPORT_ALL_COOKIES; it returns a structured
  outcome so each caller keeps its own response/skip messages verbatim.
- popup.js mutedNote(text) replaces the "centered muted note" div hand-rolled
  in the platform-loading, sources-loading, and empty-sources renderers.

No version bump — no behavior change, so it rides the next real ext release
rather than forcing an AMO re-sign + reinstall.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NsmJSQxnNxGgtM5Yz4GAqi

extension/lib/api.js

@@ -96,6 +96,13 @@ class FabledCuratorAPI {
     return this.request('GET', '/extension/manifest');
   }
 
+  // The web/SPA root: baseUrl with the trailing slash + `/api` suffix stripped.
+  // Where the Vue router (artist pages) and the served XPI live, NOT the JSON
+  // API. Used by OPEN_ARTIST_PAGE + the self-update check.
+  webRoot() {
+    return (this.baseUrl || '').replace(/\/+$/, '').replace(/\/api$/, '');
+  }
+
   // Connection test = the cheapest read with auth.
   testConnection() {
     return this.request('GET', '/credentials');