Add Copy as cURL, fix schema endpoint detection, and address audit findings

[rookieInTraining]

Features:

• Copy as cURL: generate Bash/PowerShell replay commands for any captured
  request from a modal, including the request headers captured from live
  traffic (js/ui/curl-copy.js, interceptor header normalization)

Schema loader:

• Persist observed GraphQL endpoints (with their captured headers) to
  chrome.storage.session so they survive MV3 service-worker restarts; the
  Load Schema message usually wakes a fresh worker with empty memory
• Introspect observed endpoints directly with their captured headers instead
  of probing with a bare {__typename} request, which production gateways
  (CSRF/required client headers) reject — and surface the real introspection
  error instead of a generic "no endpoint detected"

Fixes from project audit:

• CI: trigger on trunk instead of the nonexistent main branch
• Hash registry: cap at 500 entries with LRU eviction (was unbounded)
• request-list: dedupe getFilteredRequests against requestPassesFilter
• Remove dead <script>/javascript: check from validateUrlPattern
• Sync manifest.json version to 2.0.1

Docs:

• Add CLAUDE.md with commands and architecture notes
• README: correct stale module list and install steps, document passive
  mode / schema explorer / Copy as cURL, add header-capture privacy note

Tests: 200 passing — add curl-copy modal, hash-registry eviction, and
endpoint-tracker persistence suites; update schema-loader for direct
introspection.