Optimize blocking hot path and storage inefficiencies

[ACK-J]

Summary

Addresses the efficiency review items #2, #3, #5–#7 and mediums #8–#12 (DNS / Selective Allow double-work left alone).

Changes

• Sync webRequest fast-path — evaluateRequestSync returns a plain { cancel } when DNS is not needed; background peeks the warm compiled allowlist and avoids Promise scheduling on first-party / allowlisted / literal-local / known-TMX hits.
• Compiled allowlist — compileAllowlist() preclassifies exact hosts, portless IPs, and CIDRs (with masks) so matching is Set/integer checks instead of per-request URL + CIDR reparsing.
• Popup single fetch — one getTabActivity round-trip populates both blocked ports and hosts.
• Dirty activity persistence — skip storage writes when nothing changed; replace structuredClone with targeted Set→array snapshots.
• Native storage values — stop double-JSON.stringify; legacy string cells still decode on read.
• Mediums — Sets for port/host membership; normalize hostname once in the filter; cheaper IPv6 literal gate; suffix-list rebinding helpers; pass originHost into notifications.

Tests

npm test — 679 passed.

Out of scope

DNS-on-every-third-party-host (#1) and Selective Allow double-parse / uncached cross-origin list (#4).