feat: disable until configured + auto permission request for custom domains

Interception is now completely inactive until the user configures
at least one identity field or explicit mapping. Before that:
- Icon shows gray (unconfigured)
- No fetch/XHR hooks fire
- First-run banner tells user to set up

Custom domains: clicking "Add Domain" in Options now triggers
the browser's native permission prompt via permissions.request().
No more manual chrome://extensions site access step.

Icon states are now:
- Gray = unconfigured (nothing will happen)
- Black = active and protecting
- Blue = reveal mode on
- Red = manually disabled

https://claude.ai/code/session_01Dvgwe7XMoSxnWXkih8p1Cw

src/background/service-worker.js

@@ -264,9 +264,20 @@ function generateIcon(color, size) {
 }
 
 async function updateIcon(settings) {
+  // Check if identity is configured
+  const identity = await Storage.getIdentity();
+  const mappings = await Storage.getMappings();
+  const configured = mappings.length > 0 ||
+    (identity.emails || []).length > 0 ||
+    (identity.names || []).length > 0 ||
+    (identity.usernames || []).length > 0 ||
+    !!identity.catchAllEmail;
+
   let color;
   if (!settings.enabled) {
     color = '#dc2626'; // red — disabled
+  } else if (!configured) {
+    color = '#9ca3af'; // gray — not configured, effectively disabled
   } else if (settings.revealMode) {
     color = '#1d4ed8'; // blue — reveal mode
   } else {
@@ -285,10 +296,10 @@ async function updateIcon(settings) {
   }
 }
 
-// Update icon when settings change
+// Update icon when settings, identity, or mappings change
 api.storage.onChanged.addListener(async (changes) => {
-  if (changes.ss_settings) {
-    const settings = { ...(changes.ss_settings.newValue || {}) };
+  if (changes.ss_settings || changes.ss_identity || changes.ss_mappings) {
+    const settings = await Storage.getSettings();
     await updateIcon(settings);
   }
 });