fix: background-script fetch (CSP/mixed-content), prefer-Spotify links, toolbar icon (task/fix-extension-and-linkui)

The extension linked nothing and the resolver saw no requests: the content script
fetched http://localhost:8787 directly from the HTTPS reddit page, which reddit's CSP /
mixed-content blocks. Move the network call to a background script (extension origin,
exempt) and add stage logging so failures are visible.

- extension/background.js (new): does the resolver fetch on message; sets the toolbar badge.
- extension/content.js: talks to background via runtime messaging (no page-context fetch);
  [rsl] console logs at boot/root/candidates/resolve/scan; single primary link.
- extension/manifest.json: background.scripts + browser_action (icon.svg, title).
- extension/{styles.css,icon.svg}: platform-coloured link (green=spotify, teal=bandcamp) + toolbar icon.
- service/lib.js: primaryOf()/isSearchUrl() — link Spotify when the artist is on Spotify,
  else Bandcamp, else Spotify search; spotifyResult/mbResult attach `primary` (unit-tested).
- README: link behaviour, toolbar, Troubleshooting.

Verified: scripts/check.sh green (10 tests); resolver returns `primary` end-to-end. The
in-browser fix is logic-verified only (no headless Firefox here) — reload the temp add-on
and watch the page console `[rsl]` logs to confirm.

Source: project human-feedback 2026-06-16 (notes 01KV8VC58QMYBDY6VVVJHR8YNY + 01KV91AMJCN2C4GFCKMKQRGNXE).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

service/lib.js

@@ -19,12 +19,26 @@ export function pickArtist(name, items, { minScore = null } = {}) {
   );
 }
 
+// A "/search" url means we don't have a direct artist page (just a search fallback).
+export const isSearchUrl = (url) => typeof url === "string" && url.includes("/search");
+
+// Choose the single best link to show: prefer Spotify when the artist is actually ON
+// Spotify (a direct, non-search url); else a direct Bandcamp; else the Spotify search.
+export function primaryOf({ spotify, bandcamp }) {
+  if (spotify && !isSearchUrl(spotify)) return { platform: "spotify", url: spotify };
+  if (bandcamp && !isSearchUrl(bandcamp)) return { platform: "bandcamp", url: bandcamp };
+  return { platform: "spotify", url: spotify };
+}
+
 // Link object for a confirmed Spotify hit (direct artist url when present, else search).
-export const spotifyResult = (hit) => ({
-  name: hit.name,
-  spotify: hit.external_urls?.spotify ?? spotifySearch(hit.name),
-  bandcamp: bandcampSearch(hit.name),
-});
+export function spotifyResult(hit) {
+  const r = {
+    name: hit.name,
+    spotify: hit.external_urls?.spotify ?? spotifySearch(hit.name),
+    bandcamp: bandcampSearch(hit.name),
+  };
+  return { ...r, primary: primaryOf(r) };
+}
 
 // Extract direct links from a MusicBrainz artist's url-relations (zero-cred: MB stores
 // official Bandcamp / streaming URLs). Either field may be null.
@@ -37,9 +51,10 @@ export function relUrls(relations) {
 // Link object for a confirmed MusicBrainz hit: prefer the direct url-rel links, fall back
 // to search urls when MB has no relation for that platform.
 export function mbResult(hit, links) {
-  return {
+  const r = {
     name: hit.name,
     spotify: links?.spotify ?? spotifySearch(hit.name),
     bandcamp: links?.bandcamp ?? bandcampSearch(hit.name),
   };
+  return { ...r, primary: primaryOf(r) };
 }