[callumalpass]

Brings https://mdbase.dev/apps/reader/extension/privacy/ in line with the shipped extension, as listed in mdbase-dev/mdbase-reader docs/extension-store-checklist.md and checked against mdbase-reader origin/main (bce5dc81).

Privacy page

• Website access: https://*/* is requested at install (apps/extension/scripts/extension-manifest.mjs). Removed the "optional saved-page recognition" wording and the "turn it off to remove the permission" controls. Users can limit site access in Chrome. Settings → Pages you visit (SiteAccessStatus.tsx) can ask Chrome to restore it.
• Saved-page recognition: now says the extension queries the selected collection. It keeps an hourly-refreshed index of hashed saved addresses (saved-url-index.ts), sends a visited address when it matches that index (background-page-status.ts), and sends the current tab's address while the side panel is open (use-extension-capture.ts).
• PDFs: downloaded in the page with credentials: "include" (page-capture.ts), with a direct extension fetch as fallback. PDFs go only to the collection, and cookies are not exported.
• Wikimedia Citoid: off by default (citoid-setting.ts). When it's on and no DOI citation is found, the page address goes to Citoid without credentials. PDFs, private or local hosts, IP addresses and token-like query parameters are excluded (web-capture/src/citoid-url.ts, provider-claims.ts). The existing DOI paragraph already covered doi.org.
• log.mdbase.dev: described as the SDK's first-party collection log and file transport, not analytics (production SDK packaged-trust.js, manifest host permissions). The existing "no advertising or third-party analytics SDK" statement still holds: no such dependency exists in the extension or the SDK.
• Local storage: added grants, the account email shown in the extension, and the hashed saved-page index. No chrome.storage.sync use.
• Removed claims with no code behind them: "Settings → Disconnect this browser → Disconnect and clear local data" (absent from the extension and SDK), and direct localhost/local-network access to the desktop app (the SDK's browser-direct-access reports unsupported). Uninstalling the extension is now the documented way to clear its browser data.
• Effective date: 2 November 2026.

Extension guide (/apps/reader/extension/): fixed the same "Mark pages I've saved is off by default / optional HTTPS permission" claims, and noted Citoid and log.mdbase.dev.

Checks: ran pnpm test locally against sources at the pinned site-sources.json refs (check, build, import:spec, check:links). All passed.