fix(permissions): request host permissions during user gesture, not in background

chrome.permissions.request() must be called synchronously within a user
gesture. Moving it from the background message-router (where the gesture
context has expired) into the addVhostSubmit click handler in virtual-hosts.js
fixes the "Unchecked runtime.lastError: This function must be called during
a user gesture" console error.

extension/background/message-router.js

@@ -55,19 +55,6 @@ browser.runtime.onMessage.addListener((message, sender, sendResponse) => {
               extensionState.virtualHosts = state.virtualHosts;
               const newTlds = getActiveTlds(extensionState.virtualHosts);
               applyPAC(newTlds);
-              if (message.payload?.type === 'setVirtualHost' && message.payload?.payload?.hostname) {
-                const hostname = message.payload.payload.hostname;
-                const parts = hostname.split('.');
-                if (parts.length >= 3) {
-                  const baseDomain = parts.slice(-2).join('.');
-                  if (baseDomain !== 'hole.sail') {
-                    const origin = '*://*.' + baseDomain + '/*';
-                    browser.permissions.request({ origins: [origin] }, (granted) => {
-                      log('permissions.request for', origin, ':', granted ? 'granted' : 'denied');
-                    });
-                  }
-                }
-              }
             }
           }).catch(() => {});
         }

extension/dashboard/pages/virtual-hosts.js

@@ -180,6 +180,8 @@ function setupVirtualHostEvents() {
     if (!hsUrl || !hsUrl.startsWith('hs://')) { showModalError('modal-addVhost', 'addVhostError', 'Enter a valid hs:// URL'); return; }
     const btn = $('addVhostSubmit');
     if (btn) { btn.disabled = true; btn.textContent = 'Adding…'; }
+
+    function doAddVhost() {
       chrome.runtime.sendMessage(
         { target: 'holesail-native', action: 'send', payload: { type: 'setVirtualHost', payload: { hostname, hsUrl } } },
         (response) => {
@@ -195,6 +197,24 @@ function setupVirtualHostEvents() {
           }
         }
       );
+    }
+
+    // Request host permissions synchronously within the user gesture so Chrome
+    // allows the permissions.request call. Non-hole.sail custom domains need
+    // explicit host permission for the extension to intercept their traffic.
+    const parts = hostname.split('.');
+    if (parts.length >= 3) {
+      const baseDomain = parts.slice(-2).join('.');
+      if (baseDomain !== 'hole.sail') {
+        const origin = '*://*.' + baseDomain + '/*';
+        chrome.permissions.request({ origins: [origin] }, () => {
+          void chrome.runtime.lastError;
+          doAddVhost();
+        });
+        return;
+      }
+    }
+    doAddVhost();
   });
 
   $('removeVhostConfirm')?.addEventListener('click', () => {