feat: dynamic content script registration for custom domains

Replace tab-load-only injection with scripting.registerContentScripts()
so custom domains inject at document_start (like built-in sites) and
persist across service worker restarts. Scripts re-register automatically
when domains change. Removed domains now revoke browser permissions.

https://claude.ai/code/session_01KF4i7Ra7zCEDskxDBaNtcT

src/options/options.js

@@ -620,9 +620,17 @@ function renderDomains() {
     btn.addEventListener('click', async () => {
       const idx = parseInt(btn.dataset.index, 10);
       const domains = settings.customDomains || [];
-      domains.splice(idx, 1);
+      const removed = domains.splice(idx, 1)[0];
       settings.customDomains = domains;
       await Storage.saveSettings({ customDomains: domains });
+
+      // Revoke browser permission for the removed domain
+      if (removed) {
+        try {
+          await api.permissions.remove({ origins: [removed + '/*'] });
+        } catch (e) { /* non-fatal */ }
+      }
+
       renderDomains();
     });
   });