feat(browser-ext): move browser extension to browser-ext/ and update API client to tRPC

- Create browser-ext/ with full extension code (MV3 manifest, background
  service worker, content script, popup, options page)
- Add tRPC API client that communicates with unified monolith endpoints
- Implement cache, settings, and phishing detection utilities
- Create extension tRPC router in web app (getAuthStatus, linkDevice,
  reportPhishing)
- Configure Vite build with manifest V3 support
- Write unit tests for cache, phishing detector, and API client
- All 20 tests passing, TypeScript lint clean

browser-ext/tests/phishing-detector.test.ts

@@ -0,0 +1,48 @@
+import { describe, it, expect } from "vitest";
+import { checkUrlForPhishing } from "../src/lib/phishing-detector";
+
+describe("checkUrlForPhishing", () => {
+  it("should return isPhishing: false for a normal URL", () => {
+    const result = checkUrlForPhishing("https://www.google.com");
+    expect(result.isPhishing).toBe(false);
+    expect(result.confidence).toBe(0);
+    expect(result.reasons).toHaveLength(0);
+  });
+
+  it("should detect known phishing domains", () => {
+    const result = checkUrlForPhishing("https://shieldai-secure.com/login");
+    expect(result.isPhishing).toBe(true);
+    expect(result.reasons).toContain("Known phishing domain: shieldai-secure.com");
+  });
+
+  it("should detect suspicious URL patterns", () => {
+    const result = checkUrlForPhishing("https://login-secure.example.com");
+    expect(result.isPhishing).toBe(true);
+    expect(result.reasons.length).toBeGreaterThan(0);
+  });
+
+  it("should detect phishing with multiple signals for high confidence", () => {
+    const result = checkUrlForPhishing(
+      "https://shieldai-verify.com/account-update/verify",
+    );
+    expect(result.isPhishing).toBe(true);
+    expect(result.confidence).toBeGreaterThan(0.5);
+    expect(result.reasons.length).toBeGreaterThanOrEqual(1);
+  });
+
+  it("should handle invalid URLs gracefully", () => {
+    const result = checkUrlForPhishing("not-a-valid-url");
+    expect(result.isPhishing).toBe(true);
+    expect(result.reasons).toContain("Invalid URL format");
+  });
+
+  it("should detect phishing with subdomain of known domain", () => {
+    const result = checkUrlForPhishing("https://login.shieldai-secure.com");
+    expect(result.isPhishing).toBe(true);
+  });
+
+  it("should not flag legitimate shieldai.com URLs", () => {
+    const result = checkUrlForPhishing("https://api.shieldai.com/api/trpc");
+    expect(result.isPhishing).toBe(false);
+  });
+});