feat: first-run setup banner when identity is unconfigured

Shows a red warning banner at the top of the popup when no identity,
email, username, or explicit mappings are configured. The status dot
turns orange (instead of green) to indicate the extension is active
but not protecting anything yet. Banner disappears as soon as the
user saves their identity.

Prevents users from thinking they're protected when nothing has
been configured.

https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw

src/popup/popup.css

@@ -242,6 +242,40 @@ body {
   white-space: nowrap;
 }
 
+/* First-run banner */
+.first-run-banner {
+  display: flex;
+  align-items: flex-start;
+  gap: 10px;
+  padding: 10px 16px;
+  background: #fef2f2;
+  border-bottom: 1px solid #fecaca;
+}
+
+.first-run-icon {
+  width: 22px;
+  height: 22px;
+  border-radius: 50%;
+  background: #dc2626;
+  color: #fff;
+  font-size: 14px;
+  font-weight: 700;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  flex-shrink: 0;
+}
+
+.first-run-text {
+  font-size: 12px;
+  color: #991b1b;
+  line-height: 1.4;
+}
+
+.first-run-text strong {
+  font-weight: 600;
+}
+
 /* Identity tab */
 .id-section {
   margin-bottom: 12px;