fix: vendor hls.js locally (CSP) and handle null executeScript results

Two fixes addressing kfj001 review #37 on commit b19035a:

1. Vendor hls.js bundle locally — chrome.runtime.getURL('hls.min.js')
   instead of CDN, bypassing site CSP (script-src 'self') blocks.
   Added hls.min.js to vite.config.ts entry points, manifest web_accessible_resources.

2. Handle null entries in executeScript results — destroyed frames
   return null when allFrames:true, causing 'Cannot read properties of
   null (reading 'result')' in probeHlsManifests() and scrapeTab().
   Added null guards before accessing .result.

83/83 tests pass. Build: 10 modules, 413KB hls bundle.

src/viewer/index.js

@@ -391,7 +391,9 @@ async function probeHlsManifests(tabId) {
       target: { tabId, allFrames: true, world: 'MAIN' },
       func: m3u8DeepProbeFn,
     });
-    return results.flatMap(r => r.result || []);
+    // When allFrames is true, destroyed frames may return null entries.
+    // Filter them out before accessing .result to avoid TypeError.
+    return results.filter(r => r && typeof r === 'object').flatMap(r => r.result || []);
   } catch {
     return [];
   }
@@ -460,11 +462,16 @@ async function scrapeTab(tabId, manifests) {
       func: scrapeFn,
       args: [manifests],
     });
-    // Prefer the result with the largest video (may come from an iframe)
+    // When allFrames is true, destroyed frames may return null entries.
+    // Filter them out before accessing .result to avoid TypeError.
     const valid = results
+      .filter(r => r && typeof r === 'object')
       .map(r => r.result)
       .filter(r => r && r.videos && r.videos.length > 0);
-    if (valid.length === 0) return results[0]?.result || null;
+    if (valid.length === 0) {
+      const firstValid = results.find(r => r && typeof r === 'object');
+      return firstValid?.result || null;
+    }
     valid.sort((a, b) => {
       const aArea = a.videos[0]?.area || 0;
       const bArea = b.videos[0]?.area || 0;