Fix Server AI backend config and DevTools probe handling

[gardinermichael]

Summary

• Add lightweight root response for the local backend so opening http://localhost:8787/ does not fall through to the default Express 404 page.
• Answer Chrome DevTools localhost workspace discovery probe at /.well-known/appspecific/com.chrome.devtools.json with 204 No Content.
• Align /api/summarize validation with the extension background worker payload by removing the unused heuristicSummary requirement.
• Add a real Server URL field in the popup and persist it to continueIt.ai.serverUrl.
• Make the background worker use the configured Server URL instead of always posting to http://localhost:8787.
• Clarify in the README that Server AI is not bundled into the extension: users need either a hosted backend with maintainer-provided secrets, a local backend with their own .env key, or BYOK.
• Improve OpenRouter defaults and diagnostics: trim env values, expose non-secret config warnings in /health, warn when an OpenRouter URL is paired with a non-OpenRouter-looking key, and replace the unavailable meta-llama/llama-3.3-70b-instruct:free default with google/gemma-4-26b-a4b-it:free.

Why

Chrome DevTools probes localhost servers for automatic workspace discovery. When this backend did not handle the probe or root path, Express generated default error responses that could surface CSP noise in the browser console.

The Server AI docs also implied users could use the mode without supplying keys, but the repo does not ship a shared key and the extension should not bundle one. The keyless user experience only exists when users point the extension at a hosted backend that is already configured with provider secrets. For local use, the person running the backend must provide .env keys.

While testing Server AI, OpenRouter rejected the old default free model as no longer available for free. The new default was verified against OpenRouter and returns normal choices[0].message.content.

Validation

• node --check server/server.js
• node --check background.js
• node --check shared-ai.js
• node --check popup.js
• GET / returns 200 OK
• GET /.well-known/appspecific/com.chrome.devtools.json returns 204 No Content
• GET /health returns the configured provider/model and non-secret warnings array
• POST /api/summarize with the extension payload shape reaches provider configuration logic instead of failing request validation
• Smoke-tested google/gemma-4-26b-a4b-it:free through the local backend and received ok: true with a summary