extension: prove ownership for participant color updates

[spencerc99]

Summary

• require a P-256 proof of possession for participant color PUT requests
• bind each proof to the participant ID, color, and monotonic stored version
• reject stale replayed updates atomically in the database

Rationale

A public pk_ identifier is a public key, not authorization. The worker now verifies the corresponding private-key signature before accepting a color update.

Verification

• bun run test in extension/worker (46 tests)
• bun run test --run in extension (339 tests)
• bun run test in packages/playhtml (361 tests)
• bun run test in packages/react (43 tests)
• bun run build-packages
• bunx wxt build in extension
• bun run deploy --dry-run in extension/worker

PR #264 overlap

#264 is still open and adds a broader PlayHTML auth protocol. This PR intentionally uses the existing extension ECDSA identity storage and a worker-local request format, without importing #264's unreleased common auth contract. The only conceptual overlap is shared P-256 identity usage; the changed files do not overlap #264's extension files (background.ts, content.ts).

No extension/PENDING.md entry: this is a transparent security hardening change, not user-facing shipped behavior.

[pkg-pr-new]

Open in StackBlitz

bun add https://pkg.pr.new/@playhtml/common@307

bun add https://pkg.pr.new/playhtml@307

bun add https://pkg.pr.new/@playhtml/react@307

commit: 3721209

[spencerc99]

Code review

• P2 extension/src/storage/playerColor.ts:45 changes behavior that ships in the extension, but this PR does not add the required release-note bullet to extension/PENDING.md. The scoped extension instructions explicitly require a PENDING entry whenever extension/src/** changes (extension/CLAUDE.md:23-28); transparent security hardening is not listed as an exception. Add a short user-facing bullet describing the protected participant-color update.

• P3 extension/db/migrations/006_participant_color_proof.sql:1 violates the repository's mandatory two-line ABOUTME: header rule for code files. Replace the single free-form comment with the required two-line file description.