Fixes a defect that made the extension non-functional in Firefox.

The background script never loaded. The manifest declared it via
background.scripts, which runs as a classic script, while the build emitted an
ES module — a top-level import in a classic script is an immediate SyntaxError.
The background therefore never executed, so no message listener was registered,
protection status never resolved, and the URL blocklist was never applied.

1.5.4 declares "type": "module", which the WebExtensions schema supports for
background.scripts. A check now runs on every build and fails it if a manifest's
declared script format disagrees with what the bundler emitted, so this class of
defect cannot ship again.

Also in this release: the extension icons shown in browser settings and the
toolbar are regenerated from the same master as the store icon (previous
releases shipped an unrelated placeholder), and the version string displayed in
the popup no longer drifts from the packaged version.

Corrects the extension's store summary, which described "10 layers of protection." The extension ships nine detection engines; the count of ten had included one behaviour that lives inside another engine and one feature that is opt-in and off by default. The summary now says what actually ships.

Also included from 1.5.2: the toolbar popup no longer gets stuck on "Loading Click Protect..." and shows an explicit error with a Retry button if it cannot reach the background page.

Fixes a bug that could leave the toolbar popup stuck on "Loading Click Protect..." instead of showing protection status. The popup now shows an explicit error with a Retry button if it cannot reach the background page.

Also corrects wording across the welcome screen and website so that every capability claim matches what the extension actually ships.

v1.4.0 — The Shield Wall Update
NEW: 5 Advanced Shields added on top of the 5 Core Engines
• QR Phishing Scanner — detects malicious QR codes on web pages
• Dark Pattern Detector — flags deceptive UI tricks
• AI Chat Privacy Firewall — blocks prompt exfiltration in AI chatbots
• Prompt Poaching Shield — prevents invisible prompt theft from copied text
• Extension Supply Chain Detector — alerts on suspicious browser extensions

PRIVACY & SECURITY
• URL hash k-anonymity (Safe Browsing v4 prefix pattern)
• Tamper-resistant state logging with uninstall feedback flow
• Enhanced social media security scanner with geolocation checks

DETECTION
• Social engineering patterns expanded (QR-quishing, tech support scams)
• MAIN-world bridge for detecting fetch/sendBeacon/XHR exfiltration
• Domain age enrichment via RDAP (flags domains < 7 days old)
• Cross-script correlation: +15-25% confidence boost on multi-detector flags

• Social Media Safety Score — Automatically verify your Facebook, Instagram,
X, LinkedIn, and TikTok security settings (2FA, privacy, DMs, location)
when you visit their settings pages. No manual self-assessment needed.

• Zero-Day Phishing Detection — New heuristics catch minimal credential
harvesters, fake MFA pages, subdomain bait, QR-code quishing, and
late-injected SPA forms that bypass traditional blocklists.

• Behavioral Exfiltration Monitor — Detects fetch, sendBeacon, XMLHttpRequest,
and rapid pushState abuse used by modern phishing kits.

• Privacy Mode Enforcement — STRICT mode now redacts threat payloads and
URL hashes. FORTRESS mode suppresses all telemetry and heartbeats.

• Held-Out Detection Benchmark — 88.9% STANDARD / 100% AGGRESSIVE
catch rate on unseen threats with 0% false positives on benign flows.

Improvements:
• Reduced permission surface — 'management' is now an optional permission
• LRU cache eviction prevents memory growth on long sessions