Initial commit: Share-as-QR Firefox extension with bun build

MV3 WebExtension that turns the active tab's URL into a scannable QR
code via a toolbar popup. The popup runs locally — no network requests.

Build pipeline: `bun build` bundles popup.js + the vendored
kazuhikoarase/qrcode-generator (MIT, pinned to 83b7e8f) into a single
~23 KB minified ESM file under dist/. web-ext operates on dist/, so
the packaged zip contains only what actually ships (~28 KB).

Scripts:
- bun run build    — bundle + copy assets into dist/
- bun run lint     — build + web-ext lint (0 errors / 0 warnings)
- bun run package  — build + produce a signable .zip
- bun run start    — build + launch Firefox with the extension loaded

Tracks dogcat epic firefox-share-as-qr-35mw and its 5 child tasks
(scaffold, vendor lib, popup UI, icons, README).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

README.md

@@ -0,0 +1,65 @@
+# Share as QR
+
+A small Firefox extension that turns the current tab's URL into a scannable QR
+code, so you can hand a page off to a phone (or another machine) without
+typing.
+
+Click the toolbar icon → a popup shows the QR code plus a "Copy URL" button.
+Nothing leaves your browser.
+
+## Develop
+
+This project uses [bun](https://bun.sh) as both the script runner and the
+bundler. `popup/popup.js` imports the vendored QR library; `bun build` inlines
+it into a single ESM file under `dist/`. Firefox loads the extension from
+`dist/`, never from the source tree directly.
+
+```sh
+bun run build      # bundle popup.js + assets into dist/
+bun run lint       # build + web-ext lint
+bun run package    # build + produce a signable .zip in web-ext-artifacts/
+bun run start      # build + launch Firefox with the extension loaded
+```
+
+To load the extension manually after a build:
+
+1. Open `about:debugging#/runtime/this-firefox` in Firefox 142 or newer.
+2. Click **Load Temporary Add-on…** and pick `dist/manifest.json`.
+
+The temporary install is wiped when Firefox restarts; reload it the same way
+during dev.
+
+## Privacy
+
+The extension makes no network requests. The QR code is generated locally in
+the popup using the bundled `vendor/qrcode.js` library. The
+`browser_specific_settings.gecko.data_collection_permissions` field in the
+manifest declares "none" accordingly.
+
+Permissions used:
+
+- `activeTab` — read the active tab's URL when the popup opens.
+- `clipboardWrite` — used by the Copy URL button.
+
+Browser-internal URLs (`about:`, `chrome:`, `view-source:`, `moz-extension:`,
+`data:`, `javascript:`, `resource:`) are not QR-encoded — the popup shows a
+friendly message instead.
+
+## Third-party code
+
+- `vendor/qrcode.js` — [kazuhikoarase/qrcode-generator](https://github.com/kazuhikoarase/qrcode-generator),
+  pinned to commit `83b7e8fe3fddd3b0368dbafd6ce56995bd25e3c8`. MIT licensed;
+  full license text in `vendor/LICENSE.qrcode-generator` (also copied into
+  `dist/` so it ships with every build).
+
+## Project layout
+
+```
+manifest.json          MV3 manifest
+popup/                 Toolbar popup source (HTML/CSS/JS)
+vendor/qrcode.js       Bundled QR encoder (MIT, vendored, imported by popup.js)
+icons/icon.svg         Toolbar icon (single SVG, used at every size)
+scripts/build.mjs      Bun build + asset copy → dist/
+web-ext-config.cjs     Tells web-ext to operate on dist/
+dist/                  Build output (gitignored). What ships.
+```