perf: cache settings and JWT username in proxy request handler

Avoid hitting browser.storage.local and decoding JWT on every HTTP request.
Also fix sendMessage to use Firefox-native Promise API, remove unused
permissions (webRequest, activeTab, httpbin), close web_accessible_resources
security hole, extract shared UI utils, and fix theme event previousTheme bug.

improve auth refresh

improve token refresh

fix infinite loop if reauth fails

add alias to list of servers