Fix frame locate tripping the signed-out guard

A frame-targeted step resolved the element inside the checkout iframe and
reported that iframe's URL as the result `url`. The signed-out guard keys off
`url` to decide whether the tab is on the login page, and Lucid's checkout
iframe sits on the apex host (lucidtrading.com) that its signedOutPattern
matches — so a signed-in checkout looked signed out, ran the login step, and
failed with no login button present.

Report the TOP tab's URL as `url` (from pageFrameOffset), keeping the child
frame's URL as `frameUrl`. Extension 0.14.0.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

extension/background.js

@@ -292,6 +292,11 @@ function pageFrameOffset(frameSelector) {
         rect: { left: r.left, top: r.top, width: r.width, height: r.height },
         src: frame.getAttribute('src') || frame.src || '',
         name: frame.getAttribute('name') || '',
+        // The TOP tab's URL. The signed-out guard keys off "what page is the tab
+        // on", which is a top-frame fact — the child frame's own URL (e.g. a
+        // checkout iframe on the apex host) is not it, and reporting that instead
+        // makes the guard fire while signed in.
+        topUrl: location.href,
         screenX: window.screenX,
         screenY: window.screenY,
         chromeHeight: window.outerHeight - window.innerHeight,
@@ -889,7 +894,10 @@ async function serveLocateRequest(cfg) {
                 inputType: hit.inputType,
                 covered: hit.covered,
                 coveredBy: hit.coveredBy,
-                url: hit.url,
+                // The tab's page, for the signed-out guard — not the child frame's
+                // own URL, which is kept as frameUrl for debugging.
+                url: offset.topUrl,
+                frameUrl: hit.url,
                 viewport: {
                     x: offset.rect.left + hit.viewport.x,
                     y: offset.rect.top + hit.viewport.y,