feat: NMH dual-path IPC — WebSocket primary + NMH fallback

[easyvibecoding]

Summary

• Upgrade Native Messaging Host from config-only to full WS relay, enabling Chrome Extension to submit keys and query state when
  WebSocket is disconnected (SW wake, Core restart)
• New sendRequest() unified dispatch in service-worker.ts: WS → NMH fallback with request-response correlation + 5s timeout
• Popup shows three connection states: Connected (WebSocket) green / Connected (NMH) blue / Offline red
• NMHInstaller auto-installs NMH binary + Chrome manifest on Core startup

Changes

NativeMessagingHost.swift

• Add WS relay support: get_state, submit_captured_key, toggle_demo_mode
• Short-lived URLSessionWebSocketTask connections (~20-60ms)
• clientType "nmh", 5s timeout, auto-skips event messages
• writeJSON fallback on serialization failure

IPCServer.swift

• Add .nmh case to ClientType enum
• broadcast() skips .nmh clients (short-lived connections don't receive events)

service-worker.ts

• sendRequest() unified entry: WS → NMH fallback
• pendingRequests Map for WS request-response tracking (with reject on close)
• ws.onclose properly rejects all pending promises so NMH fallback triggers
• Security red line: submit_captured_key does NOT queue plaintext keys to chrome.storage.local on dual failure
• NMH get_state does NOT set isConnected = true (NMH is one-shot relay, not persistent)
• Silent errors replaced with structured console.warn logging

popup.ts / popup.html

• Connection path display: WebSocket (green) / NMH (blue) / Offline (red)
• Capture mode visible when NMH is reachable

NMHInstaller.swift (new file)

• Auto-checks and installs NMH binary + Chrome manifest on Core startup
• Binary size comparison for version checking
• install.sh retained as manual fallback

Documentation

• CLAUDE.md: 4 new Key Technical Decisions
• implementation-status.md: NMH ❌→✅
• chrome-extension-architecture.md: NMH section rewritten (dual-path diagram)
• extension-boundaries.md: NMH spec table expanded
• protocol-spec.md: new NMH Relay section + clientType nmh

Security

• ✅ NMH WS relay connects to 127.0.0.1 only
• ✅ Plaintext keys never stored in chrome.storage.local (security red line feat: implement Chrome Extension Native Messaging Host #1)
• ✅ NMH stores no data, relay only
• ✅ allowed_origins restricted to Extension ID

Test plan

• swiftc NativeMessagingHost.swift compiles successfully (93KB)
• NMH get_config returns correct port/token
• NMH get_state relay returns isDemoMode + activeContext (~23ms)
• NMH toggle_demo_mode relay toggles correctly (~18ms)
• NMH submit_captured_key relay stores successfully (~56ms)
• Core offline → NMH returns core_unreachable (<100ms)
• Unknown action → structured error response
• Popup: debugDisconnectWS() → Offline → reopen popup → Connected (NMH) blue dot
• Popup: debugReconnectWS() → Connected (WebSocket) green dot
• Swift Core build passes
• TypeScript type-check + lint + build pass

🤖 Generated with Claude Code