Add url mode for extensions

[Anton-Horn]

Extensions can now point a panel at a remote https url instead of shipping a frontend or spawning a server:

{ "id": "acme.crm", "name": "Our CRM",
  "panels": [{ "id": "main", "label": "CRM" }],
  "url": "https://app.hubspot.com" }

The panel is a top level webview, not an iframe, so SaaS apps that set X-Frame-Options or frame-ancestors still load. Logins persist because each extension already gets its own persist:ext-<id> partition.

Security

url guests get no cate host API. Guest identity comes from the proxy origin plus the opaque route token, which a remote origin can never satisfy, so handing one the bridge would only create rejected calls and extra surface for a third party page. The resolver returns an empty preloadPath, and webSecurity strips the preload for any non proxy origin anyway, so it is enforced twice. A cateApi in a url manifest is inert.

Off-screen culling

Webview extensions were exempt from the canvas viewport cull, because unmounting destroys the guest and loses in-page state. That is right for local extensions and wrong for url ones: they are third party SaaS apps that would otherwise stay resident forever, each a renderer with websockets and timers. Their login lives in the session partition, so a remount just reloads.

So url-mode panels now get culled like editors and terminals, while frontend and server extensions keep the old behaviour. An extension whose manifest is not loaded yet stays mounted, which is the safe direction. Tab-hidden behaviour is unchanged: a dock tab switch never reloads.

The cost is that panning back to a culled panel reloads the page, so scroll position and unsaved in-page drafts are lost. The cull margin is a full screen in each direction. If some extension genuinely needs to stay resident, a manifest keepAlive: true would be the escape hatch, not built yet.

Notes

• Mode precedence is server > url > frontend. Only https is accepted, including no http://localhost, since local servers are what server mode is for.
• getProxyUrlFor returns early before starting the proxy or minting a route token, so url extensions spawn nothing.
• The on disk manifest test skips when cate-extensions is not checked out, since it is a separate repo and gitignored here.

Extensions using this land separately in cate-extensions, after this: 0-AI-UG/cate-extensions#21