Fix Manifest V3 CSP violation, add test suite, and wire up CI

[Copilot]

The extension's Quick Action buttons were silently broken due to a Manifest V3 CSP violation, and there was no test coverage or functional CI pipeline.

Bug fix — inline onclick blocked by MV3 CSP

MV3 enforces script-src 'self', which silently drops all inline event handlers. Replaced onclick="openUrl(...)" with data-url attributes and moved wiring to popup.js:

<!-- before: silently blocked by CSP -->
<button class="action-btn" onclick="openUrl('https://dash.cloudflare.com/?to=/:account/pages')">

<!-- after: wired via addEventListener in popup.js -->
<button class="action-btn" data-url="https://dash.cloudflare.com/?to=/:account/pages">

// popup.js
function initActionButtons() {
  document.querySelectorAll('.action-btn[data-url]').forEach(btn => {
    btn.addEventListener('click', function() { openUrl(this.dataset.url); });
  });
}

popup.js refactor for testability

• Wrapped all initialization into named functions (initSearch, initActionButtons, initKeyboardShortcuts)
• Added CommonJS export guard so Jest can import functions while Chrome loads the file normally via init()

Tests — 22 cases covering all advertised features

Added tests/popup.test.js with jest + jest-environment-jsdom. Covers openUrl, updateStats, initSearch, initActionButtons, and initKeyboardShortcuts (including all three keyboard shortcuts and focus behavior).

CI — actually runs tests now

ci.yml was echo "Build steps pending". Now runs npm ci && npm test.

Other

• manifest.json: added "tabs" permission (explicit requirement for chrome.tabs.create)
• Dockerfile: was referencing non-existent src/index.js; now runs the test suite in-container
• Added package.json (Jest config, npm test script) and .gitignore

Original prompt

Let's ensure this repo actually does what it says it does. If not or minimal, make a plan and execute a solution please and thank you

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.