feat: support explicitly reviewed browser extensions

[AjnasNB]

Outcome\n\nAllow operator-supplied unpacked extensions for dedicated persistent Chromium profiles when the host explicitly enables this surface.\n\n## Required boundary\n\n- disabled by default\n- extension paths must be explicit, local, canonical, and allowlisted by the host\n- no automatic extension discovery from daily browser profiles\n- headed persistent context only unless a tested Chromium mode supports it\n- extension identity and digest recorded in evidence\n- Maqam approval can authorize an allowlisted extension use, but cannot add a new path or widen its authority\n\n## Acceptance\n\n- typed configuration and policy fields\n- digest and provenance receipts\n- server host-configuration gate\n- negative path-traversal and unapproved-extension tests\n- security and deployment documentation