feat(browser-ext): move browser extension to browser-ext/ and update API client to tRPC

- Create browser-ext/ with full extension code (MV3 manifest, background
  service worker, content script, popup, options page)
- Add tRPC API client that communicates with unified monolith endpoints
- Implement cache, settings, and phishing detection utilities
- Create extension tRPC router in web app (getAuthStatus, linkDevice,
  reportPhishing)
- Configure Vite build with manifest V3 support
- Write unit tests for cache, phishing detector, and API client
- All 20 tests passing, TypeScript lint clean

browser-ext/tests/api-client.test.ts

@@ -0,0 +1,90 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { createApiClient } from "../src/lib/api-client";
+
+vi.mock("@trpc/client", () => ({
+  createTRPCProxyClient: vi.fn(() => ({
+    spamshield: {
+      checkNumber: {
+        query: vi.fn().mockResolvedValue({
+          isSpam: true,
+          score: 0.85,
+          category: "scam",
+        }),
+      },
+      classifySMS: {
+        query: vi.fn().mockResolvedValue({
+          isSpam: false,
+          score: 0.1,
+          category: "legitimate",
+        }),
+      },
+    },
+    extension: {
+      getAuthStatus: {
+        query: vi.fn().mockResolvedValue({ linked: false }),
+      },
+      linkDevice: {
+        mutate: vi.fn().mockResolvedValue({
+          linked: true,
+          deviceId: "dev-123",
+        }),
+      },
+      reportPhishing: {
+        mutate: vi.fn().mockResolvedValue({
+          reported: true,
+          url: "https://phishing.com",
+        }),
+      },
+    },
+  })),
+  httpBatchLink: vi.fn(),
+}));
+
+describe("createApiClient", () => {
+  let client: ReturnType<typeof createApiClient>;
+
+  beforeEach(() => {
+    client = createApiClient("https://api.shieldai.com/api/trpc", "test-key");
+  });
+
+  it("should create a client", () => {
+    expect(client).toBeDefined();
+  });
+
+  it("should check phone number reputation", async () => {
+    const result = await client.spamshield.checkNumber.query({
+      phoneNumber: "+1234567890",
+    });
+    expect(result).toBeDefined();
+    expect(result.isSpam).toBe(true);
+    expect(result.score).toBe(0.85);
+  });
+
+  it("should classify SMS text", async () => {
+    const result = await client.spamshield.classifySMS.query({
+      text: "Hello, this is a test message",
+    });
+    expect(result).toBeDefined();
+    expect(result.isSpam).toBe(false);
+  });
+
+  it("should get auth status", async () => {
+    const result = await client.extension.getAuthStatus.query();
+    expect(result).toEqual({ linked: false });
+  });
+
+  it("should link device", async () => {
+    const result = await client.extension.linkDevice.mutate({
+      extensionId: "ext-123",
+    });
+    expect(result.linked).toBe(true);
+    expect(result.deviceId).toBe("dev-123");
+  });
+
+  it("should report phishing", async () => {
+    const result = await client.extension.reportPhishing.mutate({
+      url: "https://phishing.com",
+    });
+    expect(result.reported).toBe(true);
+  });
+});