Show the person's 2FA code on the firm site the extension is on

On a firm site, the extension draws a small corner chip with this
machine's person's authenticator code for that site, a countdown, and a
Copy button. It can be minimised to a "2FA" pill for the tab's session.

- /api/autobuyer/otp?host= relays to the master's
  /api/otp?person=<instance_id>&host=, which matches the host to a firm's
  Site link and the person's assigned codes. No master link, a master
  that can't be reached, or no match all come back as no codes. An answer
  without scope: 'person' is refused: an older master ignores ?person=
  and would return every stored code.
- The chip lives in a shadow root, counts down on its own, refetches
  when a code expires, and stays hidden for a minute after the runner
  last located something, so automated clicks never land on it. Copy
  uses execCommand inside the click, since the async Clipboard API can
  stall on a permission prompt, and leaves focus in the site's code field.
- Apex (*.apextraderfunding.com) joins host_permissions, which also
  brings it into capture like the other firm sites. Version 0.16.0.
- CatalogFirm mirrors the master's new optional siteUrl.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

extension/README.md

@@ -58,6 +58,27 @@ going back to `<all_urls>`: it would put every tab you visit in reach, and limit
 firm needs its host in *both* lists — `host_permissions` and the `content_scripts`
 matches — or captchas on that site will have no callback to fire.
 
+## 2FA codes
+
+On a firm site, the extension shows the machine's person's authenticator code
+for that site in a small chip in the bottom-right corner, with a Copy button
+(minimise it to a "2FA" pill; that sticks for the tab's session).
+
+```
+extension  --GET /api/autobuyer/otp?host=<tab host>-->  dashboard
+dashboard  --GET <master>/api/otp?person=<instance_id>&host=<tab host>-->  master
+```
+
+The master holds the secrets and matches the host against each firm's **Site**
+link (Firms page), then returns the codes assigned to this person and that firm
+(Codes page). The chip only needs a code to be assigned — it doesn't wait for a
+code field. It stays hidden for a minute after the runner last located
+something, so automated clicks never land on it.
+
+A new 2FA site needs its host in `host_permissions` (not the captcha
+`content_scripts` list), a Site link on its firm on the master, and its codes
+assigned on the master's Codes page.
+
 ## Notes
 
 - The extension never captures the dashboard's own pages — otherwise it would