feat(extension): add Twitter setup wizard UI

[xiaoland]

What changed

• add an optional setup contribution to the running Web Extension module contract
• add a Setup action and popup shell to enabled/running Extension cards
• add Twitter's four-step whole-Extension wizard: choose/enable Core, configure the OAuth App and connect X, choose/create a Bookmark Source, then review/start collection
• extend the existing authenticated Peer client with abort propagation and correct request replay after a 401 refresh
• advance @inkcre/core to 0.1.1 and the Twitter Module Federation Distribution to 0.2.0
• regenerate the database types/runtime evidence from Core contract v3

Why

An installed and enabled Extension still needs a guided route to an operational deployment-wide configuration. The Client owns only the popup shell; Twitter owns the stepper and command semantics. Provider callback handling stays on Core, so the flow introduces no postMessage or Web-origin coupling.

Dependency and impact

Depends on InKCre/core-py#52.

• setup is offered only when this Web Peer is enabled and its exact Remote runtime is active
• the wizard can choose a reachable Core Peer and requires explicit user confirmation before enabling Twitter there
• closing the popup aborts requests/polling; disabling the Web Remote first unmounts contributed setup UI
• the Client does not read or write raw Extension state and does not implement OAuth itself
• no Registry publication, production deployment, or real-X black-box acceptance is included

This PR must remain merge-blocked until Core PR #52 lands and the generated contract is refreshed against the admitted Core revision. Rollback is a normal code revert; no Client-owned database migration is introduced.

Verification

• pnpm check
  • format, lint, and type checks passed
  • 21 Vitest files / 88 tests passed
  • all workspace builds and package-contract checks passed
• pnpm contract:check -- --image sha256:1159b60622cf3b24caa32a037d8c28ffaef79262523f7dd2565393e1b09d2dfd
  • exact Core contract v3 verified through the Supabase CLI
• Twitter native Module Federation manifest/asset closure passed
• git diff --check