feat: auto-detect unconfigured PPI — warns before sending

Scans outbound messages AFTER all substitutions for personal data
the user forgot to configure:

- Private/public IP addresses (skips 127.0.0.1, 8.8.8.8, etc.)
- MAC addresses
- Street addresses ("123 Main St")
- GPS coordinates
- Dates (possible DOBs)
- EIN/tax IDs
- Home directory paths not caught by smart patterns
- Shell prompts (user@host)
- Git remotes (reveals username/org)
- Environment variable assignments (HOME=, USER=, etc.)

Shows a floating dark warning banner (top-right, auto-dismisses
after 15s) listing each detected item with its type, value, and
hint. Skips values already in the user's identity config.

Also shows PPI warnings in the popup Test tab and adds toggle
in Options to disable auto-detect.

https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw

src/popup/popup.js

@@ -1,6 +1,7 @@
 import SubstitutionEngine from '../lib/substitution-engine.js';
 import SmartPatterns from '../lib/smart-patterns.js';
 import SecretScanner from '../lib/secret-scanner.js';
+import AutoDetect from '../lib/auto-detect.js';
 import Storage from '../lib/storage.js';
 import api from '../lib/browser-polyfill.js';
 
@@ -607,7 +608,20 @@ function renderTestDiff() {
   if (explicitCount > 0) parts.push(`${explicitCount} explicit`);
   if (secretCount > 0) parts.push(`${secretCount} secrets redacted`);
   if (warnCount > 0) parts.push(`${warnCount} warnings`);
+
+  // Auto-detect unconfigured PPI in the final text
+  const ppiWarnings = AutoDetect.scan(finalText, identity);
+  if (ppiWarnings.length > 0) parts.push(`${ppiWarnings.length} PPI detected`);
+
   stats.textContent = `${allReplacements.length} substitution${allReplacements.length !== 1 ? 's' : ''} (${parts.join(', ')})`;
+
+  // Show PPI warnings below stats
+  if (ppiWarnings.length > 0) {
+    stats.innerHTML += `<div style="margin-top:6px;padding:6px 8px;background:#fef3c7;border-radius:4px;color:#92400e;font-size:11px">
+      <strong>Unconfigured PPI detected:</strong>
+      ${ppiWarnings.map(w => `<div style="margin-top:3px"><code style="background:#fff;padding:1px 4px;border-radius:2px;color:#b45309">${escapeHtml(w.value)}</code> — ${w.hint}</div>`).join('')}
+    </div>`;
+  }
 }
 
 // --- Reveal Diff (fake → real) ---