fix: cross-browser sync decryption + WebAuthn on extension pages

Sync code import between browsers was failing with "Wrong key or
corrupted data" because each browser derives a different AES key
from the same password (different salt). The decrypt function was
using the local device's salt instead of the source device's salt
embedded in the sync envelope.

Fixed _decryptFromSync to always use the sync envelope's salt for
decryption. If the cached key's salt doesn't match, forces re-auth
so the password is re-entered and a new key is derived with the
correct salt.

Also fixed WebAuthn "device can't be used" error on extension pages.
chrome-extension:// and moz-extension:// origins are not valid for
WebAuthn. isWebAuthnAvailable() now returns false on extension pages.

https://claude.ai/code/session_01SWSwDfMVij53bCTNSCLMwn

src/lib/crypto.js

@@ -374,6 +374,9 @@ const SilentSendCrypto = {
    * Check if WebAuthn is available in this browser.
    */
   isWebAuthnAvailable() {
+    // WebAuthn doesn't work on extension pages (chrome-extension:// origin)
+    if (typeof location !== 'undefined' && location.protocol === 'chrome-extension:') return false;
+    if (typeof location !== 'undefined' && location.protocol === 'moz-extension:') return false;
     return !!(window.PublicKeyCredential && navigator.credentials);
   },