fix: use script.src for content.js interceptor injection to bypass CSP

The inline script.textContent injection in content.js violated the
strict CSP on sites like Pornhub ('script-src' without 'unsafe-inline').

Move interceptor code to a separate interceptors.js file and inject
via script.src = chrome.runtime.getURL('interceptors.js'). Chrome
treats extension-originated <script src> as content scripts — not
as page inline code — so the page's CSP does not apply.

- New src/inject/interceptors.js with all main-world interceptor code
- content.js now creates <script src> instead of <script textContent>
- Vite config updated to build interceptors.js to dist/

vite.config.ts

@@ -57,6 +57,9 @@ export default defineConfig({
         content: resolve(__dirname, 'src/content/content.js'),
         viewer: resolve(__dirname, 'src/viewer/viewer.html'),
         viewerIndex: resolve(__dirname, 'src/viewer/index.html'),
+        probeFn: resolve(__dirname, 'src/viewer/probeFn.js'),
+        scrapeFn: resolve(__dirname, 'src/viewer/scrapeFn.js'),
+        interceptors: resolve(__dirname, 'src/inject/interceptors.js'),
       },
       output: {
         entryFileNames: '[name].js',