fix: Firefox broken — CSP blocks inline early hook script — v2.0.11

The inline <script> with textContent was blocked by claude.ai's
Content Security Policy on Firefox (Chrome is more permissive).
No fetch interception = no substitution = completely broken on FF.

Fixed by moving the early fetch hook to its own file (early-hook.js)
loaded via <script src="..."> which is CSP-compliant. Added to
web_accessible_resources in both Chrome and Firefox manifests.

Also fixed duplicate 'const api' declaration in injector.js that
would have crashed the content script.

https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn

manifest.firefox.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "Silent Send",
-  "version": "2.0.10",
+  "version": "2.0.11",
   "description": "Intercepts personal info and substitutes it with user-defined replacements before sending to AI services.",
   "browser_specific_settings": {
     "gecko": {
@@ -86,7 +86,7 @@
   ],
   "web_accessible_resources": [
     {
-      "resources": ["src/content/content.js"],
+      "resources": ["src/content/content.js", "src/content/early-hook.js"],
       "matches": ["<all_urls>"]
     }
   ]