Fix 4 P1 and 2 P2 code review findings for FRE-4576

P1 fixes:
- Fix import paths in background/index.ts (./ -> ../lib/)
- Fix Promise-in-string bug in api-client.ts authenticate()
- Add missing background/service_worker key to manifest
- Copy HTML to public/ so Vite places them in dist

P2 fixes:
- Add notifications permission to manifest
- Make showWarningNotification async with proper await

Co-Authored-By: Paperclip <noreply@paperclip.ing>

packages/extension/public/manifest.json

@@ -3,12 +3,16 @@
   "name": "ShieldAI - Phishing & Spam Protection",
   "version": "0.1.0",
   "description": "Real-time phishing detection and spam protection powered by ShieldAI",
+  "background": {
+    "service_worker": "background.js"
+  },
   "permissions": [
     "activeTab",
     "storage",
     "tabs",
     "scripting",
-    "declarativeNetRequest"
+    "declarativeNetRequest",
+    "notifications"
   ],
   "host_permissions": [
     "https://*/*",