Improve token setup docs, add fine-grained token support, fix host_permissions

[mgrobaker]

Summary

This PR improves token documentation, adds fine-grained PAT format support for future compatibility, and fixes a bug preventing API requests in local development.

Changes

1. Added fine-grained token format support in options.html

Updated the token input pattern to accept github_pat_* format:

- pattern="[\da-f]{40}|ghp_\w{36,251}"
+ pattern="[\da-f]{40}|ghp_\w{36,251}|github_pat_\w{82}"

While fine-grained PATs don't work yet (GitHub doesn't offer a Notifications permission), this future-proofs the extension for when GitHub adds that permission.

2. Fixed missing host_permissions in manifest.json

Added "host_permissions": ["https://api.github.com/*"] which is required for Manifest V3 extensions to make cross-origin fetch requests. Without this, locally-loaded extensions fail silently.

3. Improved token setup documentation

• Step-by-step instructions with direct links to GitHub token creation
• Clear scope table: notifications (required) vs repo (optional for private repo deep links)
• Explains why fine-grained PATs don't work yet (GitHub's fine-grained PAT system has no Notifications permission)
• Security note for users concerned about repo scope

4. Other documentation improvements

• Consolidated GitHub Enterprise setup with step-by-step instructions
• Renamed "Permissions" → "Extension Permissions" to distinguish from GitHub token scopes
• Fixed "Notifications Permission" description (applies to all desktop notifications, not just public repos)
• Added "Testing Your Setup" section suggesting users watch a busy repo like microsoft/vscode

5. Security fixes

Ran npm audit fix to address vulnerabilities with non-breaking updates.

Test plan

• Verify classic PAT with notifications scope works (badge count)
• Verify fine-grained PAT is accepted by input but fails with 403 (expected until GitHub adds Notifications permission)
• Verify locally-loaded extension makes API requests successfully

🤖 Generated with Claude Code