eat: implement Holesail-Browser enhancement plan

- Add unit tests (hostname-validator, TLDs, payload-schemas) and integration tests for message handler registry
- Refactor native host message router into handler registry (handlers/state, tunnels, ssh, rdp, backup, ca, connections)
- Add ESLint config and npm test + lint steps in CI
- Dashboard: visibility-based refresh pause, configurable refresh interval (2s/5s/10s/paused)
- Accessibility: ARIA on nav and modals, focus trap and restore, prefers-reduced-motion
- Empty states: primary action buttons for virtual hosts, servers, service tunnels
- Native host rate limiting for backup and CA operations; update SECURITY.md
- CONTRIBUTING: "Adding a new dashboard page", dev workflow; add npm run dev script

extension/dashboard/pages/service-tunnels.js

@@ -46,7 +46,8 @@ function updateServiceTunnelsTable(state) {
         <div class="empty-state">
           <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5"><path d="M12 2L2 7l10 5 10-5-10-5z"/><path d="M2 17l10 5 10-5"/><path d="M2 12l10 5 10-5"/></svg>
           <div class="empty-state-title">No service tunnels</div>
-          <div class="empty-state-desc">Click "Add Tunnel" to connect a remote TCP/UDP service via Holesail</div>
+          <div class="empty-state-desc">Forward a remote hs:// peer to a local TCP port (e.g. database, API).</div>
+          <button type="button" class="btn btn-primary empty-state-btn" data-open-modal="modal-addServiceTunnel">Add your first service tunnel</button>
         </div>
       </td></tr>`;
     _updateSvcBulkBar();