PixelProof v1.3.0: Attack-audit security hardening across the scanner and Chrome extension

An internal attack-audit pass found and closed nine issues in one day: the Chrome extension's host permissions and domain lock were tightened and CORS was scoped down, the storefront-fetch helper got SSRF hardening, and the email-capture and scan endpoints picked up rate limiting after a spam-relay path was found. Security headers (CSP, X-Frame-Options, HSTS) and a CSRF Origin allowlist went on every state-changing POST route.

The Chrome extension's store-domain validator now enforces `.myshopify.com`/`admin.shopify.com` explicitly rather than a looser pattern match. A cyber-insurance activation alert cron and `insurance_status` table shipped for the M2 milestone, and a routing-and-quick-wins pass closed out a plf audit's P0 finding on root routing.