Fix substitution breaking after sync import with at-rest encryption

When at-rest encryption is enabled, injector.js detects encrypted blobs
in storage, passes empty config to the content script, and waits for a
vault:unlocked broadcast from the background. That broadcast was only
ever triggered when the user explicitly entered their password in the
popup. After a Gist/URL sync import (which writes newly-imported data
in encrypted form), no page ever received the decrypted config, so
substitution silently stopped working.

Two fixes:

1. injector.js: when isLocked is true (encrypted blobs detected), send
   vault:request-unlock to the background. If the key is already cached
   (e.g. the user authenticated during the sync pull), the background
   responds immediately with vault:unlocked containing the decrypted
   data. This fixes every new page load after a sync import.

2. service-worker.js: add vault:request-unlock handler that checks
   Storage.isLocked() and, if the key is available, reads decrypted
   mappings/identity/settings and sends vault:unlocked back to the
   requesting tab.

3. options.js: after a successful Gist or URL pull, send vault:unlocked
   to the background so it broadcasts decrypted data to all currently-
   open tabs immediately, without requiring a page reload.

https://claude.ai/code/session_01QJnEnLfbXKR5FSCQ3Qfs53

src/background/service-worker.js

@@ -184,6 +184,23 @@ const messageHandlers = {
     sendResponse({ locked });
   },
 
+  // Content script requests decrypted data on page load when it sees
+  // encrypted storage but the key is already cached (e.g. after a sync import).
+  async 'vault:request-unlock'(_message, sender) {
+    const locked = await Storage.isLocked();
+    if (locked) return; // key not available — user must unlock via popup
+
+    const mappings = await Storage.getMappings();
+    const identity = await Storage.getIdentity();
+    const settings = await Storage.getSettings();
+    api.tabs.sendMessage(sender.tab.id, {
+      type: 'vault:unlocked',
+      mappings,
+      identity,
+      settings,
+    }).catch(() => {});
+  },
+
   async 'vault:unlocked'() {
     // User unlocked the vault — clear the LOCK badge and refresh icon
     api.action.setBadgeText({ text: '' });