fix: correct privacy note — storage is unencrypted

browser storage.local is plain JSON on disk, not encrypted like
saved passwords (which use OS-level Keychain/DPAPI). Be honest
about the security model.

https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw

src/popup/popup.html

@@ -174,8 +174,9 @@
     <footer class="footer">
       <div class="privacy-note">
         Your data never leaves your browser. No servers, no tracking, no analytics.
-        Identity data is stored in local browser storage only — as secure as your
+        Identity data is stored unencrypted in local browser storage — anyone with
-        browser's saved passwords. Nothing is transmitted anywhere.
+        access to your computer could read it. This is the same as browser cookies
+        and localStorage, not as secure as saved passwords (which are OS-encrypted).
       </div>
       <a href="#" id="btnOptions">Options</a>
     </footer>