fix: harden extension security and plugin reliability

Address audit findings across background handlers, openers,
plugins, and UI: URL allowlists, XSS reductions, popup lifecycle
fixes, plugin dispose/cleanup, cloud sync hardening, global search
mathjs sandbox, and settings storage fixes.

src/seqta/utils/Openers/OpenBsCloudAutoSyncAnnouncement.ts

@@ -61,11 +61,12 @@ export function showBsCloudAutoSyncAnnouncement(onDismissed?: () => void) {
     </div>
   `).firstChild as HTMLElement;
 
-  settingsState.bsCloudAutoSyncAnnouncementShown = true;
-
   openPopup({
     header,
     content: [imageContainer, text],
-    afterClose: onDismissed,
+    afterClose: () => {
+      settingsState.bsCloudAutoSyncAnnouncementShown = true;
+      onDismissed?.();
+    },
   });
 }