Fix: browser-granted permissions weren't registering the content script
If you granted site access through the browser's own UI (the toolbar icon's "Site access" menu, or "allow on all sites" in the extensions manager) instead of Haze's in-app grant prompt, the permission was recorded but the engine never actually got injected on that site - so rules on non-Google sites silently did nothing, even though no permission prompt was outstanding.

Background now reconciles against the browser's actual granted permissions on startup/update, not just its own synced list, so already-granted sites pick up their content script retroactively.
Listens for permission grants going forward, however they happen, and registers the content script immediately.

Fix: rules now work on new devices without seeing spoilers first
Building on v2.5.0's synced rules, this makes the permission grant proactive. The prompt to enable a site no longer waits until you're already on it (by which point the unblurred content is already visible).

Popup now shows a banner listing every synced site that still needs permission on this device, from any page — grant them all in one prompt so they blur before you visit.
Same one-click prompt appears in the options page on open, and auto-fires right after an import.
Note
Browsers require a one-time permission approval per device (a host permission can't be granted silently). Haze collapses that into a single prompt covering all your sites, surfaced up front.