Let the master dashboard drive this instance; drop the AutoBuyer switch

Three changes that ride together because they touch the same surface.

A control link to the master. lib/master-link.ts dials out to
<master>/ws/instance and holds it open, so the dashboard can trigger a trade or
queue an AutoBuyer run here. Commands call the same functions the local pages
call — runTrade, startScheduler, queueRun — so nothing reaches the broker by a
path the UI does not also use. Reports prefer the socket and fall back to the
existing POST, which keeps older masters working unchanged.

startMasterLink is idempotent, and that matters more than it looks: getClients()
is lazy and starts the link, so the first command re-enters it from inside a
command the live socket is waiting to ack. Tearing the socket down there loses
the ack and reports a trade that actually executed as a failure — which invites
pressing the button twice.

queueRun is lifted out of the automations route so the socket and HTTP share one
copy of the input clamping that decides how many times a purchase fires.

Page capture loses its switch and gains a scope. It now runs every tick, but
only against the active tab of the last-focused window that matches
host_permissions — so it follows the page in front of you and stops when you
switch away, where before it would fall back to any firm tab left open in the
background.

autobuyer_enabled is gone entirely. The AutoBuyer is ready whenever the runner
is; a run happens because someone asked for one. That does mean a queued run
executes as soon as clicker/runner.py claims it, with no second gate — stopping
the runner is now the way to make a machine idle.

Extension to 0.10.0; it needs a manual reload at chrome://extensions.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

extension/README.md

@@ -1,7 +1,8 @@
 # AutoFirmer Capture (Chromium extension)
 
-Polls the dashboard for an on/off flag and, while it's on, scrapes the target
-tab's HTML and posts it back to the dashboard.
+Scrapes the firm tab you are looking at and posts its HTML back to the
+dashboard. There is no on/off switch for that — see **Scope** below for what
+limits it instead.
 
 ## Install (unpacked)
 
@@ -12,34 +13,41 @@ tab's HTML and posts it back to the dashboard.
    - **Dashboard URL** — default `http://localhost:3000`. Use the VPS IP if the
      dashboard runs elsewhere.
    - **Poll interval** — seconds between status checks (default 3).
-   - **Target URL pattern** — a Chrome match pattern like
-     `https://*.tradovate.com/*`. Leave blank to capture whichever tab is active.
    - **Element selector** — optional CSS selector; matching elements get their
      on-screen position measured alongside the HTML.
 
-The badge shows `ON` (green) while capturing, `!` (red) if the dashboard is
-unreachable, and nothing when the switch is off.
+The badge shows `!` (red) if the dashboard is unreachable, and nothing otherwise
+— blank is the working state. Open the popup for what the last tick actually did.
 
 ## Flow
 
 ```
-AutoBuyer page  --PATCH /api/autobuyer/status-->  SQLite settings
-extension       --GET   /api/autobuyer/status-->  { enabled }
+extension       --GET   /api/autobuyer/status-->  { pendingLocate }
 extension       --POST  /api/autobuyer/capture->  html + viewport + element rects
 AutoBuyer page  --GET   /api/autobuyer/capture->  renders the HTML
 ```
 
+Nothing in that loop is switchable. Every tick serves any queued clicks and then
+captures the tab you are on.
+
 ## Scope
 
-`host_permissions` is deliberately narrow — `https://*.tradeify.co/*` plus localhost
-for the dashboard. The extension is technically incapable of reading any other site,
-so an accidental capture of your bank or mail tab can't happen. The default
-**Target URL pattern** matches, so it only ever captures the broker tab regardless
-of which tab is focused.
+Capture has no switch, so scope is what keeps it honest. Two limits, both
+enforced by Chrome rather than by this code:
+
+1. **`host_permissions` is deliberately narrow** — the firm sites plus localhost
+   for the dashboard. The extension is *technically incapable* of reading any
+   other site, so an accidental capture of your bank or mail tab cannot happen
+   however the logic here is changed.
+2. **Only the tab you are on.** `pickTab()` asks for the active tab of the
+   last-focused window *and* a host_permissions match. A firm tab sitting in the
+   background is not captured, and neither is anything else. Switch away and
+   capture simply stops until you switch back.
 
 To automate a different broker, add its pattern to `host_permissions` in
-`manifest.json`, update the popup's target pattern, and reload the extension. Avoid
-going back to `<all_urls>` — that re-enables scraping whatever tab is active.
+`manifest.json` and reload the extension — that alone scopes capture to it. Avoid
+going back to `<all_urls>`: it would put every tab you visit in reach, and limit
+1 is the only thing standing between this and scraping your whole browser.
 
 ## Notes