Rewrite as an on-device scanner (v2.0.0)

[devnsko]

v1 uploaded a screenshot of the user's tab to api.qrserver.com on every scan
and requested <all_urls> to do it. Decoding now happens entirely in the
extension: the native Barcode Detection API where Chrome offers it, with a
bundled jsQR fallback that retries at several scales with inversion enabled.
Permissions are down to activeTab and storage, and the manifest requests no
host access at all, so there is no longer any way for a capture to leave the
machine.

Security fixes carried by the rewrite:

• Decoded text was written to the popup with innerHTML; it now reaches the DOM
  only via textContent.
• Any payload was openable and non-URL text was silently prefixed with
  http://. Only http, https, mailto, tel, sms and geo are openable now;
  javascript:, data:, blob:, file: and chrome: payloads render as inert text.
• WIFI: and otpauth: payloads no longer print their password or secret key,
  though Copy still yields the raw value.
• History entries are keyed by id rather than array position, so deleting one
  row no longer removes a different one.

Also adds: scanning from a file, a drop, or the clipboard; payload
classification for links, email, phone, SMS, geo, Wi-Fi, contacts and
authenticator keys; a redesigned popup with light/dark/system themes, focus
states and reduced-motion support; an Alt+Shift+Q shortcut; extension icons at
every size; unit tests, ESLint, a Web Store packaging script, and CI.

Sources move to src/, split into decoder, payload and history modules.

Co-Authored-By: Claude Opus 5 noreply@anthropic.com
Claude-Session: https://claude.ai/code/session_015zpzWoinoS9nn1K735wAkQ