Patch release that fixes Chrome and Zoho OAuth access errors reported by users on 1.0.1.

Fixed:
- Chrome OAuth (Gmail): launchWebAuthFlow is now invoked from the background service worker so the auth window is no longer torn down when the popup is dismissed before completing consent. Previously this produced a "user cancelled the flow" error even on successful grant.
- Chrome extension load failure: removed the stale oauth2 block that Plasmo 0.90.5 was writing into the dev manifest. Chrome rejected the bundle on load; Firefox and Edge were unaffected.
- Gmail Web client secret requirement: the Web application OAuth client used for multi-account Gmail login now ships the client_secret. Without it, the Google token endpoint returned "400 invalid_request: client_secret is missing".
- Zoho OAuth: the OAuth callback handler now distinguishes between a missing/expired authorization code and an explicit user denial. Previously both surfaced as the same generic "Zoho login failed" toast.
- OAuth flow state machine: the redirect handler was refactored to be idempotent under tab races and to surface a per-step error code (redirect_missing, state_mismatch, provider_denied).

Changed:
- Onboarding auto-return: after adding an account, the inbox view is now opened automatically when the new account becomes available. Prevents the empty-state loop on slow Zoho token exchanges.

No new permissions, host permissions, content scripts, or network endpoints. Manifest version stays at 3 across all three targets (Chrome, Firefox, Edge).

Firefox review cleanup release.

Changes in 1.0.1:
- Removed Firefox-incompatible sidePanel permission and side panel build artifacts from the Firefox package.
- Removed legacy chrome.identity.getAuthToken/removeCachedAuthToken usage from the submitted code path.
- Changed sanitized mail body rendering to avoid direct raw innerHTML assignment in UniMail code.
- Hardened mail link sanitization for javascript:, data:, and vbscript: href values.