Fix popup overflow clipping, share.tsx React bypass, type divergence, settings debounce, and 6 other improvements

[Copilot]

Ten medium-priority code quality and UX issues identified in a deep audit: popup content clipping, unnecessary React bundling, dead types, keystroke-level storage writes, a race condition, dead API surface, excessive inline styles, DOM style mutation, redundant URL parsing per render, and missing password validation.

Changes

UX

• popup.html: Replace height:500px; overflow:hidden with min-height/max-height + overflow-y:auto — content was silently clipped

Bundle / File Type

• share.tsx → share.ts: File used raw DOM only; .tsx extension caused React (~40KB) to be included unnecessarily. Updated vite.config.ts entry point accordingly.

Type Cleanup

• types/index.ts: Delete UserSettings (6-field interface, exported but never used). StoredSettings in StorageService.ts is the single source of truth.

Storage

• options/options.tsx: Debounce huntModeMessage and huntModeHashtags saves by 400ms using local state + useRef timers — previously wrote on every keystroke, risking Chrome's MAX_WRITE_OPERATIONS_PER_MINUTE (120) limit.

AuthService

• deleteAccount(): Add missing await before this.clearAuth() — race condition where token could persist after account deletion.
• Remove dead methods resetPassword() and updateUser() (no UI callers) and their associated private types.

CSS / Styles

• SharePromptModal: Extract all inline style objects to named CSS classes in popup.css. Replace onMouseOver/onMouseOut DOM style mutation with CSS :hover / :focus-visible.
• AssetThumbnail: Move display:flex; align-items:center; gap from inline styles to .asset-website and .asset-status CSS rules. Extract hunt share button styles to .hunt-share-buttons, .share-btn.share-x, .share-btn.share-copy.

Performance

• popup.tsx: Move new URL(asset.sourceWebsite.url).hostname out of the JSX render expression into a pre-computed variable — was re-parsing the URL on every render for every asset.

Auth Validation

• AuthForm.tsx: Add minLength={8} on the password field for signup mode (minLength={1} for login), client-side length check in handleSubmit, and an inline hint shown while typing if the password is too short.

Security

• share.ts: Validate nid against /^[a-zA-Z0-9_-]+$/ before use; set anchor href and textContent via DOM properties instead of interpolating into innerHTML (XSS). Add noopener,noreferrer to window.open() for the Twitter share link.