fix: Firefox signing — proper .env loading and config rename

The previous approach (source .env && npm run sign:firefox) failed
because npm subshells don't inherit env vars consistently, and
quoted values in .env weren't being stripped.

New approach: sign-firefox.sh reads .env itself, strips quotes,
and passes --api-key/--api-secret directly to web-ext sign.

Also renames web-ext-config.js → web-ext-config.cjs to fix the
deprecation warning, and bumps package.json version to 0.2.0.

https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw

package.json

@@ -1,6 +1,6 @@
 {
   "name": "silent-send",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "private": true,
   "description": "Browser extension that substitutes personal data before sending to AI services",
   "scripts": {
@@ -8,7 +8,7 @@
     "build:firefox": "./build.sh firefox",
     "build": "./build.sh both",
     "lint:firefox": "npx web-ext lint --source-dir dist/firefox",
-    "sign:firefox": "./build.sh firefox && npx web-ext sign --source-dir dist/firefox --artifacts-dir dist/firefox-signed --channel unlisted",
+    "sign:firefox": "./sign-firefox.sh",
     "run:firefox": "./build.sh firefox && npx web-ext run --source-dir dist/firefox"
   },
   "devDependencies": {