Migrate secrets to Fnox (replace .env.submit + optional .env)

[sm17p]

Summary

Adopt the fnox CLI for secret injection and profiles. Migrate sensitive variables from .env.submit (Chrome Web Store / Firefox AMO publish credentials) and optional .env (e.g. WXT_GA_API_SECRET for the WXT build) so secrets can be encrypted in fnox.toml (or provider-backed) instead of local dotenv files.

Background

• WXT exposes only WXT_* / VITE_* to import.meta.env (WXT env docs). Example: WXT_GA_API_SECRET in src/app.config.ts.
• .env.submit is for store submission (CHROME_*, FIREFOX_*, etc.) — not bundled in the extension; consumed by submit/CI tooling. It is gitignored (.env*).
• Fnox injects env via fnox exec -- <command> or shell integration; use profiles (e.g. dev vs submit/production) per Fnox profiles.

Proposed work

1. Install fnox, fnox init, optional age encryption; optionally pin CLI in mise.toml.
2. Inventory: map .env.submit keys vs WXT_* build vars; assign Fnox profiles (e.g. submit for store creds, default/dev for GA).
3. Migrate: fnox set per profile; configure FNOX_IF_MISSING for CI (env reference).
4. Scripts: wrap submit/release and dev/build commands with fnox exec --profile … -- or document fnox activate for shells.
5. CI: add FNOX_AGE_KEY / FNOX_AGE_KEY_FILE; run submit/build with the right profile.
6. Docs: AGENTS.md + update .cursor/skills/ if package.json scripts or release steps change (skill maintenance).
7. Cleanup: stop relying on a populated local .env.submit; optional .env.example with names only.

Verification

• Submit flow gets the same env names as before via Fnox.
• pnpm build / pnpm dev still receive WXT_GA_API_SECRET when required.
• E2E unchanged (CI only unless we add vars).
• Zips do not leak submit secrets (wxt.config already excludes *.env*).

Risks

• Contributor onboarding: document Fnox vs optional .env.example.
• Avoid dual maintenance of .env.submit and Fnox after migration.
• If .env.submit was ever exposed, rotate store credentials at Google/Mozilla.

References

• Fnox quick start
• WXT environment variables

[sm17p]

Triage pass complete.

Proposed direction:

• Keep two Fnox profiles: dev for WXT_* build vars and submit for store credentials.
• Use fnox exec --profile <profile> -- <command> in release/submit scripts to prevent accidental secret bleed.
• Keep .env.example with key names only as onboarding fallback.

Research notes:

• Fnox profile + injection model fits this repo's split between runtime build vars and submit-only creds.
• WXT only exposes prefixed vars, so this migration is mostly about command execution environment, not extension runtime wiring.

Implementation slice:

1. Introduce fnox.toml with dev + submit profiles.
2. Update submit/release scripts to run through Fnox.
3. Document local + CI setup (FNOX_AGE_KEY / missing-var behavior).

Definition of done:

• pnpm build and submit flow both work without .env.submit values on disk.
• CI can decrypt/access needed vars per profile.