Install the extension from the update server during setup

Both installers ended by telling you to load the folder unpacked, which is the
one install that can never update itself. They now offer the policy install as
a last step instead, and only fall back to those instructions when it is
declined or fails.

Windows writes to the user's own policy hive rather than HKLM, so the step
needs no elevation and no separate admin shell; -Scope Machine is still there
for every-account installs. Linux gets the counterpart script — a managed
policy file under /etc, which is root-only because Chrome reads policy from
nowhere else on that platform.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

setup-linux.sh

@@ -86,34 +86,34 @@ echo
 # The branch is named explicitly: a bare clone follows the remote's default
 # branch, which is not necessarily master.
 if [ -d "$TARGET/.git" ]; then
-    info "[1/6] existing checkout - switching to master and pulling..."
+    info "[1/7] existing checkout - switching to master and pulling..."
     git -C "$TARGET" fetch origin
     git -C "$TARGET" checkout master
     git -C "$TARGET" pull --ff-only origin master
 else
-    info "[1/6] cloning $REPO_URL ..."
+    info "[1/7] cloning $REPO_URL ..."
     git clone --branch master "$REPO_URL" "$TARGET"
 fi
 
 cd "$TARGET"
 
 # ── 2. npm ──────────────────────────────────────────────────────────────────
-info "[2/6] installing npm dependencies (a few minutes on a Pi)..."
+info "[2/7] installing npm dependencies (a few minutes on a Pi)..."
 npm install
 
 # ── 3. build ────────────────────────────────────────────────────────────────
-info "[3/6] building..."
+info "[3/7] building..."
 npm run build
 
 # ── 4. settings ─────────────────────────────────────────────────────────────
-info "[4/6] writing instance settings..."
+info "[4/7] writing instance settings..."
 node scripts/seed-settings.js "$MASTER_URL" "$INSTANCE"
 
 # ── 5. python ───────────────────────────────────────────────────────────────
 # A virtualenv rather than a system pip install: Raspberry Pi OS Bookworm
 # enforces PEP 668, so pip into the system interpreter fails outright with
 # "externally-managed-environment".
-info "[5/6] installing clicker dependencies into a virtualenv..."
+info "[5/7] installing clicker dependencies into a virtualenv..."
 VENV="$TARGET/clicker/.venv"
 [ -d "$VENV" ] || python3 -m venv "$VENV"
 "$VENV/bin/python" -m pip install --quiet --upgrade pip
@@ -126,7 +126,7 @@ fi
 
 # ── 6. autostart ────────────────────────────────────────────────────────────
 echo
-info "[6/6] Auto-start and auto-update"
+info "[6/7] Auto-start and auto-update"
 info "      Starts AutoFirmer and the clicker at login, and checks master every"
 info "      5 minutes - rebuilding and restarting when it moves. A failed build"
 info "      is never deployed."
@@ -140,6 +140,25 @@ else
     info "      Skipped. Run scripts/install-autostart.sh later to enable it."
 fi
 
+# ── 7. extension ────────────────────────────────────────────────────────────
+# Chrome refuses to side-load a CRX and will not update an unpacked folder, so
+# the extension goes in the way a self-hosted one has to: a managed-policy file
+# naming our update server. That lives under /etc, hence sudo — there is no
+# per-user equivalent on Linux.
+echo
+info "[7/7] Chrome extension"
+info "      Installs it from the update server and lets Chrome keep it current"
+info "      by itself. Needs sudo - the policy file lives under /etc."
+read -r -p "      Set this up now? [Y/n] " DOEXT
+EXTPOLICY=0
+if [ "${DOEXT,,}" != "n" ]; then
+    if sudo bash scripts/install-extension-policy.sh; then EXTPOLICY=1; else
+        warn "extension policy failed - load $TARGET/extension unpacked for now"
+    fi
+else
+    info "      Skipped. Run: sudo scripts/install-extension-policy.sh"
+fi
+
 # ── summary ─────────────────────────────────────────────────────────────────
 echo
 echo " ============================================"
@@ -159,8 +178,13 @@ else
 fi
 echo
 info "Still manual:"
-info "  - Load the Chrome extension: chrome://extensions -> Developer mode"
-info "    -> Load unpacked -> $TARGET/extension"
+if [ "$EXTPOLICY" -eq 1 ]; then
+    info "  - Restart Chrome, and remove any unpacked copy of the extension"
+    info "    (it shares the same id now, and Chrome will not load both)"
+else
+    info "  - Load the Chrome extension: chrome://extensions -> Developer mode"
+    info "    -> Load unpacked -> $TARGET/extension"
+fi
 info "  - Add your firm credentials on the dashboard's Settings page"
 if [ -n "${WAYLAND_DISPLAY:-}" ] && [ -z "${DISPLAY:-}" ]; then
     echo