fix: background-script fetch (CSP/mixed-content), prefer-Spotify links, toolbar icon (task/fix-extension-and-linkui)

The extension linked nothing and the resolver saw no requests: the content script
fetched http://localhost:8787 directly from the HTTPS reddit page, which reddit's CSP /
mixed-content blocks. Move the network call to a background script (extension origin,
exempt) and add stage logging so failures are visible.

- extension/background.js (new): does the resolver fetch on message; sets the toolbar badge.
- extension/content.js: talks to background via runtime messaging (no page-context fetch);
  [rsl] console logs at boot/root/candidates/resolve/scan; single primary link.
- extension/manifest.json: background.scripts + browser_action (icon.svg, title).
- extension/{styles.css,icon.svg}: platform-coloured link (green=spotify, teal=bandcamp) + toolbar icon.
- service/lib.js: primaryOf()/isSearchUrl() — link Spotify when the artist is on Spotify,
  else Bandcamp, else Spotify search; spotifyResult/mbResult attach `primary` (unit-tested).
- README: link behaviour, toolbar, Troubleshooting.

Verified: scripts/check.sh green (10 tests); resolver returns `primary` end-to-end. The
in-browser fix is logic-verified only (no headless Firefox here) — reload the temp add-on
and watch the page console `[rsl]` logs to confirm.

Source: project human-feedback 2026-06-16 (notes 01KV8VC58QMYBDY6VVVJHR8YNY + 01KV91AMJCN2C4GFCKMKQRGNXE).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

extension/background.js

@@ -0,0 +1,48 @@
+// Background script: performs the cross-origin fetch to the resolver, and drives the
+// toolbar badge.
+//
+// Why this exists: a content script running in the HTTPS reddit page CANNOT reach
+// http://localhost:8787 — reddit's Content-Security-Policy (and mixed-content rules)
+// block the request, so it never leaves the browser. The background page runs in the
+// extension origin (moz-extension://), which is exempt, and may fetch any host listed
+// in `permissions`. The content script therefore asks us to do the request.
+
+const api = globalThis.browser ?? globalThis.chrome;
+
+// Keep in sync with manifest.json `permissions` if you change host/port.
+const RESOLVER_URL = "http://localhost:8787";
+
+async function resolveCandidates(candidates) {
+  const r = await fetch(`${RESOLVER_URL}/resolve`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ candidates }),
+  });
+  if (!r.ok) throw new Error(`resolver http ${r.status}`);
+  return r.json();
+}
+
+api.runtime.onMessage.addListener((msg, sender) => {
+  if (!msg || typeof msg !== "object") return;
+
+  if (msg.type === "resolve") {
+    // Returning a Promise makes sendMessage() in the content script resolve with it.
+    return resolveCandidates(msg.candidates)
+      .then((data) => ({ ok: true, data }))
+      .catch((e) => {
+        console.warn("[rsl/bg] resolve failed:", e && e.message);
+        return { ok: false, error: String((e && e.message) || e) };
+      });
+  }
+
+  if (msg.type === "badge") {
+    const tabId = sender.tab && sender.tab.id;
+    if (tabId != null) {
+      const n = msg.count | 0;
+      try {
+        api.browserAction.setBadgeBackgroundColor({ color: "#1db954", tabId });
+        api.browserAction.setBadgeText({ text: n > 0 ? String(n) : "", tabId });
+      } catch (e) { /* badge is best-effort */ }
+    }
+  }
+});