fix: harden extension security and plugin reliability

Address audit findings across background handlers, openers,
plugins, and UI: URL allowlists, XSS reductions, popup lifecycle
fixes, plugin dispose/cleanup, cloud sync hardening, global search
mathjs sandbox, and settings storage fixes.

src/plugins/built-in/timetable/index.ts

@@ -84,6 +84,8 @@ async function handleTimetable(): Promise<void> {
 }
 
 function handleTimetableZoom(): void {
+  if (document.querySelector(".timetable-zoom-controls")) return;
+
   console.log("Initializing timetable zoom controls");
 
   // Create zoom controls
@@ -130,6 +132,8 @@ function handleTimetableZoom(): void {
 }
 
 function handleTimetableAssessmentHide(): void {
+  if (document.querySelector(".timetable-hide-controls")) return;
+
   const hideControls = document.createElement("div");
   hideControls.className = "timetable-hide-controls";