fix: Firefox broken — CSP blocks inline early hook script — v2.0.11

The inline <script> with textContent was blocked by claude.ai's
Content Security Policy on Firefox (Chrome is more permissive).
No fetch interception = no substitution = completely broken on FF.

Fixed by moving the early fetch hook to its own file (early-hook.js)
loaded via <script src="..."> which is CSP-compliant. Added to
web_accessible_resources in both Chrome and Firefox manifests.

Also fixed duplicate 'const api' declaration in injector.js that
would have crashed the content script.

https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn

package.json

@@ -1,6 +1,6 @@
 {
   "name": "silent-send",
-  "version": "2.0.10",
+  "version": "2.0.11",
   "private": true,
   "license": "BSL-1.1",
   "description": "Browser extension that substitutes personal data before sending to AI services",