Add experimental Decoy Mode

[alex-w-developer]

Summary

• add an optional, clearly labeled experimental Decoy Mode toggle with locally persisted state and per-page decoy counts
• keep normal tracker blocking unchanged when off; when on, disable only the catalog blocking rule while retaining tracking-parameter cleanup
• intercept eligible catalog-scoped fetch, XMLHttpRequest, and sendBeacon traffic with one coherent browser-session fake profile
• preserve event and transactional fields, add explicit IP/network metadata warnings, and document supported formats and limitations
• extend unit, safety, and real-browser coverage for popup state, DNR switching, session consistency, interception, counters, and restoration

Why

Decoy Mode provides an experimental alternative to blocking for users who want supported analytics identifiers replaced consistently without generating synthetic transactions or broadening the tracker catalog.

Privacy and safety

• no new extension permissions
• no extension-owned network requests, telemetry, or remote logging
• no fabricated purchases, conversions, transactions, products, revenue, currency, or ad clicks
• tracker requests may still reveal IP address and network metadata, which is disclosed in the popup and documentation
• the main/isolated world bridge uses a private one-time MessageChannel

Validation

• npm run check
• npm run test:browser — 15 passed
• tracker evidence fixture — 24/24 catalog requests blocked in normal mode
• Markdown local-link verification
• git diff --check