fix: Firefox signing — proper .env loading and config rename

The previous approach (source .env && npm run sign:firefox) failed
because npm subshells don't inherit env vars consistently, and
quoted values in .env weren't being stripped.

New approach: sign-firefox.sh reads .env itself, strips quotes,
and passes --api-key/--api-secret directly to web-ext sign.

Also renames web-ext-config.js → web-ext-config.cjs to fix the
deprecation warning, and bumps package.json version to 0.2.0.

https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw

README.md

@@ -141,15 +141,16 @@ Save and close the file.
 
 #### Step 4: Build and sign
 
-**Mac / Linux:**
+**All platforms (Mac, Linux, Windows with Git Bash):**
 ```bash
-source .env && npm run sign:firefox
+npm run sign:firefox
 ```
 
-**Windows (Command Prompt):**
+The sign script reads your `.env` file automatically — no need to `source` it.
+
+**Windows (Command Prompt — if not using Git Bash):**
 ```cmd
-set /p x= < nul & for /f "tokens=1,* delims==" %a in (.env) do @set %a=%~b
-npm run sign:firefox
+node -e "require('fs').readFileSync('.env','utf8').split('\n').forEach(l=>{const[k,v]=l.split('=');if(k&&v)process.env[k.trim()]=v.trim().replace(/^\"|\"$/g,'')})" && npm run sign:firefox
 ```
 
 **Windows (PowerShell):**