feat: 按域名授权、iframe 多帧填充、自动提交限流修正，并补齐工程规范与文档

安全与权限：
- 站点访问权限改为 optional_host_permissions，保存配置时逐域名授权；移除 host_permissions 与 tabs，安装提示不再出现全站数据访问与浏览记录
- 主口令不再写入 storage.session，改用 IndexedDB 中不可导出的 CryptoKey 句柄恢复解锁，锁定即丢弃
- content script 注入范围只注册已授权域名，并随权限变化即时收敛

自动登录：
- 支持 iframe 内的登录表单：脚本注入所有帧，逐帧按自身地址匹配配置
- 手动填充改为逐帧探测，定向发送到真正含密码框的帧
- 限流修正：只在真正触发提交后计数；判定登录成功后立即清零；达到上限时页面给出可见提示；重置判断只看启用中的配置
- SPA 重试改为 DOM 变更门控 + 退避，并单独监听已发现的 Shadow Root

工程化与文档：
- 引入 ESLint（扁平配置）与 Prettier，CI 增加 lint 与 format:check
- 信息类日志改为 debugLog（默认静默，chrome.storage.local.debugLog 开关）
- 测试 123 → 128 用例（新增权限、iframe、限流相关用例）
- README / PRIVACY / CHANGELOG 同步

_locales/en/messages.json

@@ -551,6 +551,46 @@
     "message": "disabled",
     "description": "Config item - disabled tag"
   },
+  "attemptToastTitle": {
+    "message": "Auto-submit paused",
+    "description": "Toast title - auto submit paused"
+  },
+  "attemptToastBody": {
+    "message": "Auto-submit ran $1 times in a row for this domain. To avoid locking your account, credentials are only filled without submitting. It resumes automatically after $2 minutes, or you can click login yourself.",
+    "description": "Toast body - $1 attempt limit, $2 cooldown minutes"
+  },
+  "logLoginSuccessReset": {
+    "message": "Login appears successful ($1); attempt counter reset",
+    "description": "Log - reset attempts after success"
+  },
+  "tagUnauthorized": {
+    "message": "no access",
+    "description": "Config item - site access not granted"
+  },
+  "tagUnauthorizedTitle": {
+    "message": "Site access has not been granted, so auto-fill will not work. Click to grant access.",
+    "description": "Tooltip for the unauthorized tag"
+  },
+  "toastUnauthorized": {
+    "message": "Saved, but site access was not granted — auto-fill will not work (click \"no access\" in the list to grant it)",
+    "description": "Toast - not authorized"
+  },
+  "toastAuthorized": {
+    "message": "Access granted. Auto-fill will work on this site.",
+    "description": "Toast - authorized"
+  },
+  "toastAuthFail": {
+    "message": "Access was not granted; auto-fill stays disabled for this site.",
+    "description": "Toast - authorization denied or failed"
+  },
+  "toastNoTabUrl": {
+    "message": "Cannot read the current page URL. Click the extension icon on the target page and retry.",
+    "description": "Toast - tab URL unavailable (no activeTab grant)"
+  },
+  "toastNeedActiveTab": {
+    "message": "Cannot access the current page. Click the extension icon on the target page and retry.",
+    "description": "Toast - missing site access for injection"
+  },
   "tagDelay": {
     "message": "delay $1ms",
     "description": "Config item - delay tag, $1 ms"
@@ -764,8 +804,8 @@
     "description": "Log - captcha filled"
   },
   "logAttemptExceeded": {
-    "message": "Auto-login attempts reached limit. Fill only, no auto-submit. Confirm and click login manually.",
-    "description": "Log - attempt exceeded"
+    "message": "Auto-submit reached its limit. Fill only, no auto-submit. Confirm and click login manually.",
+    "description": "Log - auto submit limit reached"
   },
   "logNoAutoSubmit": {
     "message": "Auto-submit is off. Fill only.",
@@ -780,8 +820,8 @@
     "description": "Log - start fill, $1 env name"
   },
   "logAttemptExceededDetail": {
-    "message": "Env \"$1\" domain $2 auto-login failed $3 times, reached limit $4. Auto-submit stopped. Confirm and login manually, or retry after $5 minutes.",
-    "description": "Log - attempt exceeded detail, $1 env, $2 domain, $3 fails, $4 limit, $5 cooldown min"
+    "message": "Env \"$1\" domain $2 auto-submitted $3 times, reached limit $4. Auto-submit stopped. Confirm and login manually, or it resumes after $5 minutes.",
+    "description": "Log - limit reached detail, $1 env, $2 domain, $3 submitted, $4 limit, $5 cooldown min"
   },
   "logSpaTimeout": {
     "message": "SPA dynamic form wait timeout ($1s), stopped",