feat(extension): add screenshot-backed v1 review states

[JSONbored]

Parent phase: #235
Parent roadmap: #127

Problem

Extension work should not be accepted on code shape alone. Reviewers need actual screenshots or recordings for loading, private context, public-safe preview, blocked, unauthenticated, and error states.

Acceptance criteria

• Extension has explicit v1 states for loading, authenticated private context, unauthenticated, API error, repo unsupported, public-safe preview, and private blocker detail.
• Each visible state has screenshot or short recording evidence attached to the PR.
• Evidence confirms private-only data is not visible in public panels.

Validation expected

• Extension unit or integration tests cover state selection.
• PR includes screenshots/recording for each changed visible state.

UI evidence gate

Any visible web, browser-extension, or GitHub-overlay change must include maintainer-reviewable screenshots or a short recording covering the changed states. A checked template box without actual visual evidence is not enough.

Public-output safety criteria

• Public text is sanitized before reaching GitHub comments, issue bodies, PR bodies, extension-visible public panels, or copied public snippets.
• Tests cover forbidden wallet/hotkey, reward-estimate, trust-score, public-score-prediction, private-reviewability, private-scoreability, and farming-language leakage.

Cross-cutting acceptance criteria

• Preserve the repo quality gate: npm run test:ci, 97%+ global coverage, and the local branch coverage target for touched code.
• Keep public/private boundaries explicit. Public GitHub output must not expose wallets, hotkeys, reward estimates, raw trust scores, public score predictions, private reviewability, private scoreability context, or farming language.
• Add/update focused tests for the changed behavior instead of relying on green checks alone.