Fixes

• Pairing: the popup's pairing call was refused by the extension's own CSP —
  connect-src now also allows http://127.0.0.1/http://localhost (loopback
  only, unchanged otherwise).
• Reliability: an idle-stopped background worker never woke up, silently
  ending every connection. The alarms permission (new) wakes it on a
  30-second keepalive to re-open the loopback WebSocket. No network use beyond
  the existing local socket.
• Page reading: checkboxes reported as always ticked; toggle buttons and
  hidden checkboxes misread;
• Screenshots: capture was always refused even with site access granted; the
  refusal now names the real remedy.
• Icons fixed to the desktop app's mark.

New agent capabilities (all page interactions happen only in the tab the
user's Tidet agent is directed to, at that moment)

• Navigate, back/forward/reload; hover; drag; attach a user-pointed file;
  fill a whole form at once; write in rich-text compose boxes.
• Page diagnostics on request: console messages and failed network request
  statuses for that tab only; request contents are never read.