feat(popup): calm, trustworthy redesign of the main popup

Replace the purple/blue gradient theme with a calm slate palette and a single
trust-blue accent (semantic green/red reserved for safe/destructive actions).
Add a token-based light/dark theme via prefers-color-scheme, generous spacing,
rounded cards, subtle shadows, accessible focus rings, and inline SVG icons in
place of emoji.

- popup.css: full rewrite as a shared design system (CSS custom properties for
  surfaces, text, borders, accent, semantic colours, shape) consumed by both
  popup.html and approve.html.
- popup.html: restructured identity view — npub/DID in monospace inset cards, a
  "Session" lock pill making the session-only key legible at a glance, a
  settings toggle with a description, and a tidy trusted-sites list.
- popup.js: copy/generate now update a label span instead of overwriting button
  contents (preserves icons); loadTrustedSites rebuilds via the DOM API
  (replaceChildren/createElement) so no innerHTML is used on a surface that
  renders web-origin strings. All message protocols and DEBUG gating unchanged.

Co-Authored-By: jjohare <github@thedreamlab.uk>

Author: jjohare