fix: declare the storage permission the extension background worker needs (#26)

## Summary
Fix: background notifications never scheduled in v0.4.0.

Chrome reported `Failed to handle cancel-end: TypeError: Cannot read properties of undefined (reading 'session')` from `background.js`. The worker keeps the pending notification text in `chrome.storage.session`, which requires the `storage` permission; without it `chrome.storage` is undefined, so `schedule-end` and `cancel-end` both threw and no end-of-session alarm was ever set. The manifest now declares `storage` (no install warning). The worker's other APIs are covered: `alarms` and `notifications` are declared; `tabs.create/update`, `windows.update` and `runtime.getContexts` need no permission.

## Testing
- Lint, typecheck, unit tests and build pass.
- Built manifest lists `notifications`, `alarms`, `storage`.
- Not run here: a real Chrome with the unpacked extension (this machine's Chrome ignores command-line extension loading); the earlier stub tests only covered the page side, which is how this slipped through.

Author: ttncode

scripts/build-extension.mjs

@@ -79,8 +79,9 @@ function writeManifest() {
     version,
     description,
     icons,
-    // notifications + alarms: the background worker announces a session's end even with the popup closed.
-    permissions: ["notifications", "alarms"],
+    // notifications + alarms: the background worker announces a session's end even with the popup closed;
+    // storage: it keeps that notification's text in chrome.storage.session until the alarm fires.
+    permissions: ["notifications", "alarms", "storage"],
     action: { default_title: "Boost Focus Timer", default_icon: icons, default_popup: "popup.html" },
     background: { service_worker: "background.js" },
     // Unassigned by default; users pick a key at chrome://extensions/shortcuts.