V2: package/publish browser extensions and replace API-key auth

[commrelayunit]

Summary

Plan and spec RefHub browser extension V2 so it can be packaged/published cleanly and no longer depend on API-key-based auth.

Why

The current extension todo set is effectively done for prototype/polish. The next phase is V2 productization:

• clean packaging and publishing flow
• Chrome + Firefox release path
• store assets / release checklist
• moving away from API-key auth toward first-party session/JWT-based auth

Scope

Packaging / publishing

• Define Chrome Web Store + Firefox Add-ons release path
• Versioning / release artifact strategy
• Store assets checklist (icons, screenshots, descriptions, support/privacy links)
• Permissions justification and publishing notes
• Release workflow / CI expectations

Auth redesign

• Replace extension API-key dependency in V2
• Define first-party session/JWT-based extension auth model
• Clarify backend endpoint strategy for extension-specific auth flows
• Document how this should coexist with API keys for agents/automation

Deliverables

• docs/spec covering packaging/publishing plan
• docs/spec covering V2 auth model
• recommended rollout phases
• implementation checklist for future work

Notes

This is intentionally a V2 planning issue, not a request to keep polishing the current prototype branch.

[velitchko]

wont replace api key.

v2 is live