Support Chrome Web Store service account auth

[iFurySt]

Summary

• support Chrome Web Store API authentication with CWS_SERVICE_ACCOUNT_JSON
• keep CWS_ACCESS_TOKEN and OAuth refresh-token auth paths for local/fallback usage
• update CWS workflows and docs for service-account based CI/CD publishing

Validation

• ./scripts/ci.sh
• git ls-files '*.md' | xargs pnpm dlx markdownlint-cli2
• ruby -e 'require "yaml"; Dir[".github/workflows/*.yml"].each { |f| YAML.load_file(f); puts "ok #{f}" }'
• CWS_PUBLISHER_ID=p CWS_EXTENSION_ID=e CWS_ZIP_PATH=missing.zip node scripts/publish-chrome-web-store.mjs
• CWS_SERVICE_ACCOUNT_JSON='{}' CWS_PUBLISHER_ID=p CWS_EXTENSION_ID=e CWS_ZIP_PATH=missing.zip node scripts/publish-chrome-web-store.mjs
• git diff --check
• ./scripts/check-action-pinning.sh