feat: add HLS playback support with hls.js and modular viewer architecture

This PR adds end-to-end HLS stream detection, interception, and playback
to the viewer. The following root causes from the QA audit are fixed:

- Restore dropped HLS detection strategies (6-strategy per-tab query)
- Add deep-probe scanning for config globals and iframe manifests
- Add standalone interceptors.js for CSP-compliant runtime injection
- Fix viewer.js string entry handling for legacy storage entries
- Fix manifest.json web_accessible_resources for interceptors.js
- Disable modulePreload polyfill for Chrome MV3 compatibility
- Run deep probe and scraper in MAIN world for page global access
- Fallback to src as HLS manifest when hlsManifest field is missing

The viewer.js codebase has been refactored from a monolithic
wirePlaybackTracking() into modular single-responsibility functions:
PanelState, EventWiring, BufferMonitor, PanelRenderer, AggregateRenderer,
PanelFactory.

Additionally:
- Remove debug console.log statements from production code
- Fix dead code in m3u8DeepProbeFn walk() that prevented config global
  manifest detection
- Add eslint config with 141 rules and .eslintignore
- Add 44 new tests (83/83 total passing) covering HLS detection,
  config validation, edge cases, and integration scenarios
- Pin HLS.js CDN version to 1.5.17 (not floating/latest)
- Add grid-optimized HLS config with 10s buffer cap
- Add cleanup hooks for HLS instance destruction on page unload

Changed files (18):
- src/viewer/viewer.js (+834)
- src/viewer/index.js (+870)
- src/viewer/viewer.test.js (+976, new)
- src/viewer/index.test.js (+481, new)
- src/inject/interceptors.js (+169, new)
- src/content/content.js (+139)
- __tests__/hls_qa.test.mjs (+1168, new)
- manifest.json (+6)
- vite.config.ts (+5)
- __tests__/run.mjs (+2)
- __tests__/config_validation.test.mjs (+102, new)
- eslint.config.js (+24, new)
- .eslintignore (+1, new)
- QA_REPORT_HLS.md (+160, new)
- __tests__/data_flow.test.mjs (+/-5)
- __tests__/schema.test.mjs (+/-5)
- __tests__/viewer_integration.test.mjs (+/-4)
- src/background/background.js (-2)

src/content/content.js

@@ -24,123 +24,18 @@
 
   /**
    * Inject interceptors into the MAIN world at document_start.
-   * Runs BEFORE any page JS, so we catch all HLS activity.
+   *
+   * Uses script.src = chrome.runtime.getURL('interceptors.js') instead of
+   * script.textContent to bypass strict page CSP. Sites like Pornhub enforce
+   * 'script-src' that blocks inline execution (textContent). Chrome treats
+   * extension-originated <script src="..."> as content scripts — not as
+   * page inline code — so the page's CSP does not apply.
+   *
+   * Runs BEFORE any page JS (document_start), so we catch all HLS activity.
    */
   function injectInterceptors() {
-    const interceptCode = `
-      (function() {
-        if (window.__goon_plugin_intercepted) return;
-        window.__goon_plugin_intercepted = true;
-
-        window.__goon_plugin_data = window.__goon_plugin_data || {
-          manifests: [],
-          sources: []
-        };
-
-        // Helper: resolve relative URLs
-        function resolveUrl(url) {
-          if (!url) return null;
-          try {
-            if (url.startsWith('//')) return 'https:' + url;
-            if (url.startsWith('http')) return url;
-            return new URL(url, window.location.origin).href;
-          } catch { return null; }
-        }
-
-        // Helper: report manifest to content script via postMessage
-        function reportManifest(url, source) {
-          var resolved = resolveUrl(url);
-          if (!resolved) return;
-          if (window.__goon_plugin_data.manifests.includes(resolved)) return;
-          window.__goon_plugin_data.manifests.push(resolved);
-
-          window.postMessage({
-            type: 'GOON_PLUGIN_HLS_INTERCEPT',
-            url: resolved,
-            source: source,
-            timestamp: Date.now()
-          }, '*');
-        }
-
-        // === INTERCEPTORS ===
-
-        // 1. Intercept XMLHttpRequest for manifest-like requests
-        var originalOpen = XMLHttpRequest.prototype.open;
-        var originalSend = XMLHttpRequest.prototype.send;
-        XMLHttpRequest.prototype.open = function(method, url) {
-          this._goon_url = url;
-          return originalOpen.apply(this, arguments);
-        };
-        XMLHttpRequest.prototype.send = function(body) {
-          if (this._goon_url && typeof this._goon_url === 'string') {
-            var resolved = resolveUrl(this._goon_url);
-            if (resolved && (resolved.includes('.m3u8') ||
-                             resolved.includes('/playlist') ||
-                             resolved.includes('/manifest'))) {
-              reportManifest(resolved, 'xhr');
-            }
-          }
-          return originalSend.apply(this, arguments);
-        };
-
-        // 2. Intercept fetch() for manifest-like requests
-        var originalFetch = window.fetch;
-        window.fetch = function(resource, init) {
-          var url = typeof resource === 'string' ? resource : (resource && resource.url);
-          if (url && typeof url === 'string') {
-            var resolved = resolveUrl(url);
-            if (resolved && (resolved.includes('.m3u8') ||
-                             resolved.includes('/playlist') ||
-                             resolved.includes('/manifest'))) {
-              reportManifest(resolved, 'fetch');
-            }
-          }
-          return originalFetch.apply(this, arguments);
-        };
-
-        // 3. Intercept HLS.js loadSource (catches HLS.js instances)
-        function patchHlsPrototype() {
-          if (typeof Hls === 'undefined') return;
-          var originalLoadSource = Hls.prototype.loadSource;
-          if (!originalLoadSource) return;
-
-          Hls.prototype.loadSource = function(url) {
-            reportManifest(url, 'hls_loadSource');
-            return originalLoadSource.apply(this, arguments);
-          };
-
-          var originalAttachMedia = Hls.prototype.attachMedia;
-          if (originalAttachMedia) {
-            Hls.prototype.attachMedia = function(media) {
-              if (media && media.tagName === 'VIDEO') {
-                media._goon_hls_manifest = this.url;
-                reportManifest(this.url, 'hls_attachMedia');
-              }
-              return originalAttachMedia.apply(this, arguments);
-            };
-          }
-        }
-
-        // Patch immediately if HLS is already defined
-        patchHlsPrototype();
-
-        // Watch for HLS.js to be dynamically defined later
-        var originalDefineProperty = Object.defineProperty;
-        var hlsPatched = false;
-        Object.defineProperty = function(obj, prop, descriptor) {
-          var result = originalDefineProperty.apply(this, arguments);
-          if (obj === window && prop === 'Hls' && !hlsPatched) {
-            hlsPatched = true;
-            patchHlsPrototype();
-          }
-          return result;
-        };
-
-      })();
-    `;
-
     const script = document.createElement('script');
-    script.textContent = interceptCode;
+    script.src = chrome.runtime.getURL('interceptors.js');
     script.setAttribute('type', 'text/javascript');
     (document.head || document.documentElement).appendChild(script);
     // Remove the script element after execution but keep interceptors active
@@ -190,13 +85,13 @@
             return url;
           }
         }
-      } catch(e) {}
+      } catch(_e) {}
     }
     return null;
   }
 
   /**
-   * Get video data: intercepted manifests + DOM scan + poster.
+   * Get video data: intercepted manifests + DOM scan + poster + Hls.cast probe.
    * Called by the popup via chrome.tabs.sendMessage.
    */
   function getVideoData() {
@@ -209,15 +104,25 @@
       for (const video of videos) {
         const style = window.getComputedStyle(video);
         if (style.display !== 'none' && video.clientWidth > 0 && video.clientHeight > 0) {
+          // Extract buffered ranges as serializable arrays
+          const bufferedRanges = [];
+          if (video.buffered && video.buffered.length > 0) {
+            for (let b = 0; b < video.buffered.length; b++) {
+              bufferedRanges.push({ start: video.buffered.start(b), end: video.buffered.end(b) });
+            }
+          }
+
           videoElements.push({
             src: video.currentSrc || video.src || '',
             poster: video.poster || '',
             width: video.clientWidth,
             height: video.clientHeight,
+            duration: video.duration || 0,
+            buffered: bufferedRanges,
           });
         }
       }
-    } catch(e) { /* ignore DOM access errors */ }
+    } catch(_e) { /* ignore DOM access errors */ }
 
     return {
       posterUrl: poster,