ci: build, typecheck and test the extension

[vineethkrishnan]

The gap

No workflow touched the extension/ package at all. ci.yml ran npm ci && npm run build in web only, and grepping every workflow for "extension" returned nothing. Every green check on an extension-only PR was vacuous, because CI never compiled a line of it.

This is not theoretical:

• Dependabot's TypeScript 7 bump for the extension (chore(deps): bump typescript from 5.9.3 to 7.0.2 in /extension #320) showed all seven checks green while npm run typecheck fails outright against it. It was closed on the strength of a local run, not CI.
• feat(extension): fill the 2FA code when the entry carries a TOTP secret #328 and fix(extension): do not fill a 2FA code into a form with empty credentials #331 both changed only extension code and were merged on green checks that never built them. Both were verified locally, but CI would not have caught a break.

The job

Installs the extension, typechecks it, runs its vitest suite, and builds both the chrome and firefox targets. Any break in those now surfaces as a red check.

Why there is no npm ci in web/

mobile.yml needs an extra install in web/ because mobile/tsconfig.json maps @vaultctl/shared/* into web/src/shared/, and TypeScript resolves those files' own imports from their own location. The extension's tsconfig has the same shape, so this looked like the same trap.

It isn't. The only non-relative import those shared files carry is hash-wasm, and the extension's tsconfig maps that to its own node_modules. I verified this rather than assuming it: the entire job runs green from a clean git worktree checkout with no web/node_modules present anywhere. Adding the install would only cost CI time.

Verification

Every step was run from that clean checkout before writing the job:

npm ci          ok
npm run typecheck   ok
npm test        7 files, 74 tests passed
npm run build       ok (chrome-mv3)
npm run build:firefox   ok (firefox-mv3)

actionlint clean.