fix: harden extension security and plugin reliability

Address audit findings across background handlers, openers,
plugins, and UI: URL allowlists, XSS reductions, popup lifecycle
fixes, plugin dispose/cleanup, cloud sync hardening, global search
mathjs sandbox, and settings storage fixes.

src/interface/components/utils/ReactAdapter.svelte

@@ -1,21 +1,25 @@
 <script lang="ts">
   import React from "react";
   import ReactDOM from "react-dom";
-  import { onDestroy, onMount } from "svelte";
+  import { onDestroy } from "svelte";
 
   const e = React.createElement;
-  let container: HTMLDivElement;
+  let adapterProps = $props();
+  let container = $state<HTMLDivElement | null>(null);
 
-  onMount(() => {
-    const { el, children, class: _, ...props } = $$props;
+  $effect(() => {
+    if (!container) return;
+
+    const { el, children, class: className, ...rest } = adapterProps;
     try {
-      ReactDOM.render(e(el, props, children), container);
+      ReactDOM.render(e(el, rest, children), container);
     } catch (err) {
       console.warn(`react-adapter failed to mount.`, { err });
     }
   });
 
   onDestroy(() => {
+    if (!container) return;
     try {
       ReactDOM.unmountComponentAtNode(container);
     } catch (err) {
@@ -24,4 +28,4 @@
   });
 </script>
 
-<div bind:this={container} class={$$props.class}></div>
+<div bind:this={container} class={adapterProps.class}></div>