feat(extension): rebuild as dual-audience overlay (WXT + React)

[JSONbored]

Parent roadmap: #525
Parent phase: #527

Background

The current extension (apps/gittensory-extension/) is ~459 lines of vanilla JS, MV3, maintainer-only ("Gittensory Maintainer Overlay"), single-surface, and breaks on GitHub's SPA navigation. It cannot scale to dual-audience surfaces.

Goal

Rebuild it as a maintainable, dual-audience overlay. This issue absorbs #243 (screenshot-backed review states) and #244 (role-based private/public panel rendering).

Current Behavior

Vanilla JS content script, storage-only permission, maintainer-only, no build system, no miner auth scope.

Desired Behavior

• Adopt WXT + React + TypeScript (Vite-native — same toolchain as apps/gittensory-ui; Shadow-DOM isolation; cross-browser zip — deletes the hand-rolled ZIP writer in scripts/build-extension.mjs).
• Port verbatim the good existing logic: gts_ token validation/storage (auth.js) and matchGitHubPageTarget (content.js).
• Replace token-pasting with "Sign in with GitHub" (web OAuth → POST /v1/auth/extension/session). Add a miner auth scope (extension:contributor_context, self-only allowlist).
• Surfaces — miner: issue fit/lane/duplicate-risk, own-PR preflight + slop-risk + review/changes-requested status, issue-list badges. Maintainer: inline PR panel (parity) + PR-list triage badges. Re-mount on SPA navigation via MutationObserver.

Implementation Requirements

• New /v1/extension/* endpoints return redaction-checked payloads. Each surface is a thin React island over an existing API payload.

Public/Private Output Boundaries

• Server-side authoritative redaction + a client-side belt-and-suspenders check. Miner score preview shown as a band, never a number. Miner token can only read its own /v1/extension/contributors/<self>/*.

Acceptance Criteria

• Both audiences served; survives SPA navigation; screenshots/recording of every changed state (UI evidence gate). Incorporates feat(extension): add screenshot-backed v1 review states #243 and feat(extension): harden role-based private/public panel rendering #244 requirements.

Testing Requirements

• npm run test:ci, 97%+ coverage. Port gts_-token tests; add miner-scope allowlist tests; browser smoke for mount/re-mount.