feat(surface): BearTrap + BearWall dedicated surface page + counter chiclet

[mdheller]

Both actors were emitting the beartrap-detection observer signal but the user had no dedicated place to see caught probes / blocked vendors / canary exfiltrations. Hamburger menu items I added in #142 anchored at bearnet.html#beartrap — a page that didn't exist. This lands the real surface.

Adds

• settings/start/beartrap.html — unified surface, 3 tabs:

  • Fingerprint probes (BearTrap) — kind: 'fingerprint'
  • Blocked vendors (BearWall) — kind: 'vendor-blocked'
  • Canary tokens — kind: 'canary'

  Polls http://127.0.0.1:8093/honeypot (already exposed by capture-sidecar at server.rs:68) every 2s. Deep-link: #beartrap|#bearwall|#canary jump to the corresponding tab. credentials:'omit', cache:'no-store', referrerPolicy:'no-referrer'. Empty-state explainers.

• URL-bar counter chiclet — extends the existing observer in bearstart-autoconfig.js that already tracked fingerprint origins. Now tracks all three kinds (fingerprint / vendor-blocked / canary), sets data-block-count on the nav-bar bearnet-button, updates tooltip with a per-kind summary. Visible from any tab.

• stage-bearnet.sh — stage the new HTML into the packaged app so resource://bearstart/beartrap.html resolves.

• hamburger appMenu — update BearTrap + BearWall entries to point at beartrap.html (was the non-existent bearnet.html#beartrap anchor).

Adversarial-review checklist

• Sensitive network fetches — page fetches only http://127.0.0.1:8093/honeypot (loopback), credentials:'omit', cache:'no-store', HTML has <meta name="referrer" content="no-referrer">
• String parsers — content is escaped via escapeHTML() before insertion; no innerHTML with untrusted data
• Packaged-artifact assertions — new file added to stage-bearnet.sh staging list; verify-package.sh doesn't have a specific assertion for beartrap.html yet — follow-up
• FINAL_TARGET_FILES — N/A (page loose-staged like bearnet.html, not omni)
• Auth / IAM changes — N/A
• Version metadata — N/A
• Silent-skip guards — sidecar-offline case shown as visible 'offline' status; no silent-skip
• Firefox/Mozilla/LibreWolf strings — none

Test plan

• node -c settings/start/bearstart-autoconfig.js → syntax ok
• Basic HTML tag-balance check on beartrap.html → no mismatched tags
• Manual runtime verify: once nightly ships the page, navigate to resource://bearstart/beartrap.html, confirm sidecar polling + tab switching. This will be automated by the cockpit-boot-style integration test I'm queueing in the same day's work.