fix: reveal mode broken when encryption enabled — encrypted settings blob passed to content script

When at-rest encryption is enabled, storage.onChanged fires with
encrypted blobs for ss_settings. The injector was passing this
encrypted blob directly as settings to the page world content script,
overwriting real settings with { _ssLocalEncrypted: true, data: ... }.

This broke reveal mode, highlights, and any setting toggle because
the content script's settings object became the encrypted blob.

Fix: skip encrypted settings blobs in injector.js (same check already
existed for mappings and identity). The background's settings:updated
message already sends decrypted settings correctly.

https://claude.ai/code/session_01KF4i7Ra7zCEDskxDBaNtcT

src/content/injector.js

@@ -127,7 +127,10 @@
           const val = changes.ss_identity.newValue;
           if (!val?._ssLocalEncrypted) msg.identity = mergeProfiles(val);
         }
-        if (changes.ss_settings) msg.settings = changes.ss_settings.newValue;
+        if (changes.ss_settings) {
+          const val = changes.ss_settings.newValue;
+          if (!val?._ssLocalEncrypted) msg.settings = val;
+        }
 
         // Only post if we have something meaningful to send
         if (msg.mappings || msg.identity || msg.settings) {

src/options/options.html

@@ -629,7 +629,7 @@
     </section>
 
     <footer>
-      <p>Silent Send v0.9.3</p>
+      <p>Silent Send v0.9.4</p>
       <p style="font-size:11px;color:#9ca3af;margin-top:6px;max-width:600px">
         Silent Send is a convenience tool, not a security guarantee. Third-party sites may change how they send data at any time, which can cause missed substitutions without warning. You are responsible for verifying your data before sending. See the <a href="https://github.com/outis1one/silent-send/blob/main/LICENSE" target="_blank" style="color:#6b7280">LICENSE</a> for full terms.
       </p>