Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@index.html`:
- Around line 1867-1872: The WebDAV inputs (webdavUrlInput, webdavUsernameInput,
webdavPasswordInput) lack accessible labels; add <label> elements associated to
each input (using for="webdavUrlInput", for="webdavUsernameInput",
for="webdavPasswordInput") and use the same visible-or-visually-hidden label
pattern as editBookmarkName/editBookmarkURL so screen readers get proper labels
while preserving the existing placeholders; ensure the labels provide
descriptive text (e.g., "WebDAV URL", "Username (optional)", "Password or app
password (optional)").
- Line 1859: The Cloud Backup UI fails to translate because
scripts/backup-restore.js uses non-matching keys: update the assignment for
element id "#cloudBackupSectionTitle" in scripts/backup-restore.js (where
t("backupModuleTitle") is used) to t("cloudBackupSectionTitle"), and replace
t("cloudAutoBackupHint") with an existing locale key or add a new
"cloudAutoBackupHint" entry to all locale files (locales/*.js) so keys are
consistent; also open locales/en.js and remove the duplicated webdav entries
(keep a single set for webdavTitle, webdavBackupText, webdavRestoreText,
webdavUrlPlaceholder) ensuring the retained webdavRestoreText value is the
intended one across all locales.

In `@locales/el.js`:
- Around line 198-217: Add the missing "cloudAutoBackupHint" and
"cloudAutoBackupInvalidInterval" keys to the locales/el.js translations (the
same change should be applied to the other locale files noted), providing Greek
strings for the auto-backup toggle description and the alert when the interval
is below 1 hour; update the same translation object where "cloudAutoBackupText"
and related webdav keys live so the keys are present when
scripts/backup-restore.js looks them up.

In `@locales/en.js`:
- Around line 208-243: Remove the stale duplicate WebDAV entries (the earlier
block defining webdavTitle, webdavBackupText, webdavRestoreText,
webdavUrlPlaceholder, webdavUsernamePlaceholder, webdavPasswordPlaceholder,
webdavMissingConfig, webdavPermissionDenied, webdavBackupCompleted,
webdavDownloadFailed, webdavUploadFailed, webdavRestoreConfirm and the obsolete
webdavFileNamePlaceholder) so only the correct cloudBackupSection block remains;
then add the three missing locale keys used by scripts/backup-restore.js —
backupModuleTitle, cloudAutoBackupHint, and cloudAutoBackupInvalidInterval — (or
alternatively change the t(...) calls in backup-restore.js/applyStorageTexts()
to use the existing cloudBackupSectionTitle, cloudAutoBackupText and
cloudIntervalInvalid key names), ensuring the keys referenced in
applyStorageTexts() and by the UI elements (`#cloudBackupSectionTitle`,
`#cloudAutoBackupHint` and the invalid interval alert) match the locale file.

In `@manifest`(firefox).json:
- Around line 15-18: Remove the broad "http://*/*" and "https://*/*" entries
from the manifest's optional_permissions array and instead request precise
origins at runtime: keep only genuinely static optional permissions in
optional_permissions, and when the user supplies a WebDAV URL construct a
specific origin pattern (e.g., "https://example.com/*") and call
browser.permissions.request({origins: [constructedOrigin]}) to obtain access;
update any code that assumes the wildcard (search for optional_permissions and
any permissions.request usage) to build and request the specific origin from the
user-supplied URL before attempting WebDAV operations.

In `@scripts/backup-restore.js`:
- Around line 257-261: The code is persisting the WebDAV password in plaintext
via localStorage.setItem(STORAGE_KEYS.webdavPassword,
webdavPasswordInput.value); change this so credentials are not page-accessible:
when persisting, use chrome.storage.local (extension-isolated) instead of
localStorage for STORAGE_KEYS.webdavPassword and related WebDAV fields, and if
there's a "remember" toggle implement session-only storage (sessionStorage) when
not remembered; update any save logic around webdavUsernameInput.value,
webdavPasswordInput.value and cloudAutoBackupCheckbox to use the appropriate
storage API and ensure retrieval code reads from
chrome.storage.local/sessionStorage accordingly, and add a brief UI notice near
the WebDAV input warning users about the risk and recommending an app password.
- Around line 267-279: getWebDAVConfig currently calls new URL(baseUrl).origin
which can throw for malformed user input and surface as an upload failure;
modify getWebDAVConfig to validate/parse baseUrl inside a try/catch (or use a
safe absolute-URL check) and if parsing fails return null so callers (e.g.,
uploadSnapshotToWebDAV) treat it as missing config; ensure the returned object
still contains baseUrl, username, password and a safe requestOrigin only when
URL parsing succeeds.
- Around line 217-230: The translations use nonexistent locale keys
(backupModuleTitle, cloudAutoBackupHint, cloudAutoBackupInvalidInterval) causing
silent fallbacks; update the calls in applyStorageTexts (and the
saveBackupConfig usage) to the existing locale keys defined in your locales (or
alternatively add these three keys to every locales/*.js), i.e., change
t("backupModuleTitle") and t("cloudAutoBackupHint") in applyStorageTexts and
t("cloudAutoBackupInvalidInterval") in saveBackupConfig to match the established
keys in en.js so the UI respects the selected language.

In `@scripts/snapshot-service.js`:
- Around line 119-151: The exportObjectStore function can hang because
store.getAllKeys() and store.get(key) lack error handlers; add request.onerror
handlers for the getAllKeys() request to reject with its error, and for each
store.get(key) to reject on failure (referencing exportObjectStore,
store.getAllKeys, and the inner store.get loop), ensuring pending is
decremented/short-circuited appropriately if needed; keep the existing
transaction.onerror but ensure any rejection clears outstanding callbacks so the
returned Promise always resolves or rejects, and still await
serializeIndexedDBValue(result) inside the successful get handler.

In `@style.css`:
- Around line 4073-4079: The .cloudMethodInlinePicker rule uses an undefined CSS
variable --lightColor-blue so its background becomes transparent; update the
background-color to a valid token (e.g. --bg-color-blue or
--accentLightTint-blue) or remove the background-color declaration if no fill is
desired; modify the .cloudMethodInlinePicker selector in the stylesheet to
reference the chosen existing variable (instead of --lightColor-blue) and verify
the visual result in the UI.

---

Outside diff comments:
In `@scripts/languages.js`:
- Around line 244-256: Locale key cloudPrefixPlaceholder is defined but unused;
either remove it from all locale files or wire it into the UI by adding a
corresponding input in index.html and mapping it in scripts/languages.js's
placeholderMap. To implement the feature: add an input element for the cloud
prefix in index.html with an id (e.g., "cloudPrefixInput"), then add { id:
"cloudPrefixInput", key: "cloudPrefixPlaceholder" } to the placeholderMap array
in scripts/languages.js so loadPlaceholders/getPlaceholder logic applies;
alternatively, delete the cloudPrefixPlaceholder entries from all locale JSONs
if the feature is not needed.

---

Nitpick comments:
In `@CHANGELOG.md`:
- Line 21: Update the CHANGELOG entry that currently reads "Added WebDAV backup
and restore support, including manual cloud backup and restore for MYNT
settings." to include the author and PR attribution in the same format as other
entries (e.g., "([`@author`]) ([`#PR`])") and extend the text to mention automatic
scheduled backups support (e.g., "...including manual and automatic scheduled
cloud backups and restore for MYNT settings."), keeping punctuation and style
consistent with other [Unreleased] → Added items.

In `@index.html`:
- Around line 1897-1898: The number input with id "cloudIntervalInput" (class
"webdavInput webdavIntervalInput") currently has min="1" but no upper bound; add
a sensible max (e.g., max="720") to the input and enforce the same limit in any
client-side validation logic that reads/sets this field (validate in the form
submit handler or the function that processes cloudIntervalInput to clamp or
reject values > max), and update any placeholder/help text if necessary to
reflect the allowed range.
- Around line 1871-1872: The password input with id "webdavPasswordInput" is
missing an autocomplete hint; add autocomplete="current-password" to that
element and also add autocomplete="username" to the corresponding username input
(the WebDAV username input element, e.g., the element with id like
"webdavUsernameInput" or the form's username input) so browsers and password
managers can store/fill credentials correctly (or use autocomplete="off" on both
if you intentionally want to disable saving).

In `@locales/fa.js`:
- Around line 224-243: Change the newly added quoted object keys to the unquoted
style used elsewhere in the file: replace "cloudBackupSectionTitle",
"webdavTitle", "webdavBackupText", "webdavRestoreText", "webdavUrlPlaceholder",
"cloudPrefixPlaceholder", "webdavUsernamePlaceholder",
"webdavPasswordPlaceholder", "cloudAutoBackupText", "cloudIntervalPlaceholder",
"cloudIntervalHours", "saveBackupConfig", "backupConfigSaved",
"webdavMissingConfig", "webdavPermissionDenied", "webdavBackupCompleted",
"webdavDownloadFailed", "webdavUploadFailed", "webdavRestoreConfirm", and
"webdavLatestPointerMissing" so they appear without surrounding quotes (e.g.,
cloudBackupSectionTitle:) and preserve the exact string values and commas to
keep the object valid.

In `@manifest.json`:
- Around line 8-15: The manifest currently declares both broad wildcards in
optional_host_permissions and redundant specific origins (the
google/duckduckgo/brave/wikipedia endpoints); choose one approach and update
optional_host_permissions accordingly: either keep the wildcards (http://*/* and
https://*/*) and remove the specific endpoint entries to simplify the manifest,
or remove the global wildcards and keep only the necessary specific origins and
handle the WebDAV origin at runtime by calling permissions.request({ origins:
[...] }) via the existing ensureHostPermission logic in
scripts/backup-restore.js so you don't require full-web optional grants.

In `@scripts/backup-restore.js`:
- Around line 143-152: Remove the redundant write to
STORAGE_KEYS.cloudLastAutoBackupAt so the timestamp is only set when the upload
actually completes; specifically, keep the setLocalStorage call inside
uploadSnapshotToWebDAV (which runs when isAutomatic is true) and remove the
duplicate localStorage.setItem call in maybeRunAutomaticBackup (the block that
currently sets cloudLastAutoBackupAt around lines 302–317), ensuring only
uploadSnapshotToWebDAV updates the key to reflect successful upload completion.

In `@scripts/snapshot-service.js`:
- Around line 196-212: The openDatabase promise currently rejects with a generic
Error in request.onerror, losing diagnostic info; change request.onerror to
reject with the underlying IndexedDB error (use request.error or
event.target.error) so callers (e.g., webdavUploadFailed/restorefailed) get the
real cause, and add a request.onblocked handler that rejects or rejects with a
specific "blocked" Error (or logs and rejects) to surface upgrade blocking
conditions; locate these handlers in the openDatabase function (request.onerror,
request.onblocked) and update them accordingly.
- Around line 214-221: isTransientLocalStorageKey contains a redundant check:
key.startsWith("quotes_") already covers "quotes_metadata_timestamp", so remove
the explicit equality branch (key === "quotes_metadata_timestamp") from the
isTransientLocalStorageKey function and keep the other explicit weather-related
keys unchanged; update any surrounding comments or tests if they assumed a
separate equality check.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@README.md`:
- Line 233: Update the flag image tags in the README table to include alt
attributes and correct the Swedish flag URL: change the Swedish flag src from
flagcdn.com/sv.svg to flagcdn.com/se.svg and add alt text for each row's img tag
(e.g. alt="Hungarian flag" for the "Hungarian - Magyar" row, alt="Swedish flag"
for the "Swedish" row, and alt="Ukrainian flag" for the "Ukrainian" row) so the
Hungarian, Swedish, and Ukrainian table rows have proper alt attributes and the
correct Swedish image source.

---

Duplicate comments:
In `@locales/en.js`:
- Around line 209-221: Remove the stale duplicate WebDAV locale block (the early
set of keys including webdavTitle, webdavBackupText, webdavRestoreText,
webdavUrlPlaceholder, webdavFileNamePlaceholder, webdavUsernamePlaceholder,
webdavPasswordPlaceholder, webdavMissingConfig, webdavPermissionDenied,
webdavBackupCompleted, webdavDownloadFailed, webdavUploadFailed,
webdavRestoreConfirm) so only the newer Cloud Backup/WebDAV entries remain;
ensure you keep the canonical keyset (the later block around webdav... keys) and
delete the older duplicate to avoid duplicate object keys and obsolete wording
like "file name" and webdavFileNamePlaceholder.