NEW SITE-CAPTURE CAPABILITIES (RUNTIME)
The extension can now extract from many more kinds of sites, driven entirely by declarative source data:
- Year-partitioned listing that adapts to each account's real history (stops after empty years) — for services that only expose items one year at a time
- Multi-period lists (assemble a list from several period requests), POST-body lists, and a date window
- Two-step document resolution — fetch a small page that links the real document, then download it (host-guarded)
- Documents delivered inside JSON (base64) and absolute-URL documents
- Declarative HTML → structured JSON extraction for pages with no embedded data
- Captured context values (e.g. an account id read from a request URL) and non-JWT bearer capture, so services with opaque tokens work
- Grouped sources — pick which bank account/card first; files are organised under a per-account folder.
- Learned document metadata — real dates/amounts discovered on download are remembered and shown in later listings (useful when a site's list hides them).

COMMUNITY SOURCES SYSTEM
- Source versioning with a per-source changelog shown in the catalog, plus one-click Update (and "Update all") when a newer version is available.
- Minimum-version gating — a source declares the minimum extension version it needs; the catalog shows "needs vX+" and disables install/update on older builds.
- Record mode can now infer a source from server-rendered / "AJAX-returns-HTML" pages, not just JSON APIs, so non-technical users can author more sites.

INTERFACE
- Live listing with progress ("Listing documents from 2026, page 3…") that fills the table as rows arrive.
- Working spinner + Stop button — cancel a long list/download; whatever finished is kept.
- Incremental saving — each document is written and marked delivered as it downloads, so an interrupted run keeps its progress and never re-downloads.
- Rows enrich live as documents download (date/amount/return status fill in), and flip to "sent".

RELIABILITY & SESSION CAPTURE
- Reliable in-session authorization capture for modern single-page apps (including banks): a CSP-proof page hook (runs in the page's MAIN world), background observation of the user's own session token, and merging a token seen across sibling API hosts of the same service.
- Better re-login handling (opens the site's sign-in page; recovers from sites that corrupt their own login cookies).

PERMISSIONS
- Added cookies (only to clear a site's own corrupted login cookies) and webRequest (observation-only, to capture the user's own session token for the site they're extracting from). Both operate locally in the user's session; nothing is sent to any t