revert: restore entire src/ from pre-doc-scanner commit (e4b44a7)

Going back to a known-good baseline. This version had:
- Working reveal mode with CSS Highlight API
- Working substitution (fetch + XHR hooks)
- Smart patterns (names, emails, phones, usernames)
- Encryption/sync (password, TOTP, WebAuthn)
- Multiple identity profiles
- Activity log
- Secret scanner
- Auto-detect PII warnings
- Pre-send PII detection

Kept current manifests (UUID, data_collection_permissions, version).
No renames applied — uses original naming (secretScanning, PPI, etc).
Will re-apply renames and new features from this working base.

https://claude.ai/code/session_01KF4i7Ra7zCEDskxDBaNtcT

src/content/injector.js

@@ -57,57 +57,22 @@
 
   // Load mappings and settings, then inject into page
   async function init() {
-    let mappings, identity, settings;
-
     const result = await api.storage.local.get(['ss_mappings', 'ss_identity', 'ss_settings']);
-    const isEncrypted = result.ss_mappings?._ssLocalEncrypted ||
-                        result.ss_identity?._ssLocalEncrypted;
+    const settings = result.ss_settings || { enabled: true };
 
-    if (isEncrypted) {
-      // Data is encrypted — ask the background script for decrypted config.
-      // The background has access to the Storage module which can decrypt.
-      try {
-        const response = await api.runtime.sendMessage({ type: 'get:decrypted-config' });
-        if (response?.mappings) {
-          mappings = response.mappings;
-          identity = response.identity || {};
-          settings = response.settings || { enabled: true };
-        } else {
-          // Background couldn't decrypt (locked) — inject with empty config
-          // and wait for vault:unlocked message later
-          mappings = [];
-          identity = {};
-          settings = result.ss_settings || { enabled: true };
-        }
-      } catch {
-        mappings = [];
-        identity = {};
-        settings = result.ss_settings || { enabled: true };
-      }
-    } else {
-      // Data is plaintext — read directly
-      mappings = result.ss_mappings || [];
-      const identityData = result.ss_identity || {};
-      identity = mergeProfiles(identityData);
-      settings = result.ss_settings || { enabled: true };
-    }
+    // Check if data is encrypted (locked) — pass empty config
+    // The background will send decrypted data via vault:unlocked when ready
+    const isLocked = result.ss_mappings?._ssLocalEncrypted ||
+                     result.ss_identity?._ssLocalEncrypted;
+    const mappings = isLocked ? [] : (result.ss_mappings || []);
+    const identityData = isLocked ? {} : (result.ss_identity || {});
 
-    // Ensure identity is merged if it came from background
-    if (identity.profiles) {
-      identity = mergeProfiles(identity);
-    }
-
-    // Inject config as a global variable before loading content.js
-    // Using a separate inline-data element ensures content.js can read it
-    // even if there's a race condition with script.onload removal
-    const configEl = document.createElement('script');
-    configEl.type = 'application/json';
-    configEl.id = 'ss-config-data';
-    configEl.textContent = JSON.stringify({ mappings, identity, settings });
-    (document.head || document.documentElement).appendChild(configEl);
+    // Merge active profiles into a flat identity object for the content script
+    const identity = mergeProfiles(identityData);
 
     // Inject the main interception script into the page's world
     const script = document.createElement('script');
+    script.setAttribute('data-ss-config', JSON.stringify({ mappings, identity, settings }));
     script.src = api.runtime.getURL('src/content/content.js');
     (document.head || document.documentElement).appendChild(script);
     script.onload = () => script.remove();