fix: vendor hls.js locally (CSP) and handle null executeScript results

Two fixes addressing kfj001 review #37 on commit b19035a:

1. Vendor hls.js bundle locally — chrome.runtime.getURL('hls.min.js')
   instead of CDN, bypassing site CSP (script-src 'self') blocks.
   Added hls.min.js to vite.config.ts entry points, manifest web_accessible_resources.

2. Handle null entries in executeScript results — destroyed frames
   return null when allFrames:true, causing 'Cannot read properties of
   null (reading 'result')' in probeHlsManifests() and scrapeTab().
   Added null guards before accessing .result.

83/83 tests pass. Build: 10 modules, 413KB hls bundle.

__tests__/hls_qa.test.mjs

@@ -903,15 +903,26 @@ describe('HLS QA: Configuration and resource management', () => {
     }
   });
 
-  it('should pin HLS CDN version (not use floating/latest)', () => {
-    const cdnMatch = viewerSource.match(/const HLS_CDN = '([^']+)'/);
-    if (!cdnMatch) throw new Error('HLS_CDN not found');
-    const cdn = cdnMatch[1];
-    if (!cdn.includes('@1.')) {
-      throw new Error(`HLS_CDN should pin to specific version, got: ${cdn}`);
+  it('should vendor HLS bundle locally (not use CDN — avoids CSP blocks)', () => {
+    // Viewer loads hls.js from extension origin via chrome.runtime.getURL('hls.min.js')
+    // instead of a CDN — sites like Pornhub restrict script-src to 'self', blocking
+    // cross-origin <script src> injection from CDN URLs.
+    if (!viewerSource.includes("chrome.runtime.getURL('hls.min.js')")) {
+      throw new Error('viewer.js should load hls.min.js from extension origin, not CDN');
     }
-    if (!cdn.includes('.17')) {
-      throw new Error(`HLS_CDN version should match package.json dependency: ${cdn}`);
+    // Verify no CDN references remain (cdn.jsdelivr, unpkg, etc.)
+    const cdnRefs = viewerSource.match(/https?:\/\/(cdn\.jsdelivr|unpkg|cdnjs)/g);
+    if (cdnRefs) {
+      throw new Error(`viewer.js should not reference CDN URLs (found: ${cdnRefs.join(', ')})`);
+    }
+    // Verify the vendored bundle exists in dist
+    const hlsPath = path.join(__dirname, '../dist/hls.js');
+    if (!fs.existsSync(hlsPath)) {
+      throw new Error('dist/hls.js not found — run npm run build');
+    }
+    const hlsSize = fs.statSync(hlsPath).size;
+    if (hlsSize < 200_000) {
+      throw new Error(`dist/hls.js too small (${hlsSize} bytes) — bundle may be empty`);
     }
   });