feat: proper in-page reveal mode + privacy note

Reveal mode (eye icon) now works as intended:
- Toggle ON: all existing responses on the page get fake→real
  substitution applied immediately (paths, names, emails, etc.)
- Streaming responses are revealed in real-time as they arrive
- Toggle OFF: original text is restored from saved state
- Covers code blocks, artifacts, pre tags, and all response
  containers across all supported services
- Blue floating badge shows "Reveal Mode — showing real data"
  when active so user knows what they're seeing

The workflow is now: type /home/jsmith/... → Claude sees
/home/ademo/... → Claude responds with /home/ademo/... →
reveal mode shows /home/jsmith/... → user copies real path.

Also adds privacy note in popup footer: data stays in local
browser storage, no servers, no tracking, no analytics.

https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw

src/popup/popup.css

@@ -526,6 +526,14 @@ body {
   text-align: center;
 }
 
+.privacy-note {
+  font-size: 10px;
+  color: #9ca3af;
+  line-height: 1.4;
+  margin-bottom: 6px;
+  padding: 0 4px;
+}
+
 .footer a {
   font-size: 11px;
   color: #6b7280;

src/popup/popup.html

@@ -172,6 +172,11 @@
 
     <!-- Footer -->
     <footer class="footer">
+      <div class="privacy-note">
+        Your data never leaves your browser. No servers, no tracking, no analytics.
+        Identity data is stored in local browser storage only — as secure as your
+        browser's saved passwords. Nothing is transmitted anywhere.
+      </div>
       <a href="#" id="btnOptions">Options</a>
     </footer>
   </div>