Show the person's 2FA code on the firm site the extension is on

On a firm site, the extension draws a small corner chip with this
machine's person's authenticator code for that site, a countdown, and a
Copy button. It can be minimised to a "2FA" pill for the tab's session.

- /api/autobuyer/otp?host= relays to the master's
  /api/otp?person=<instance_id>&host=, which matches the host to a firm's
  Site link and the person's assigned codes. No master link, a master
  that can't be reached, or no match all come back as no codes. An answer
  without scope: 'person' is refused: an older master ignores ?person=
  and would return every stored code.
- The chip lives in a shadow root, counts down on its own, refetches
  when a code expires, and stays hidden for a minute after the runner
  last located something, so automated clicks never land on it. Copy
  uses execCommand inside the click, since the async Clipboard API can
  stall on a permission prompt, and leaves focus in the site's code field.
- Apex (*.apextraderfunding.com) joins host_permissions, which also
  brings it into capture like the other firm sites. Version 0.16.0.
- CatalogFirm mirrors the master's new optional siteUrl.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

lib/master-protocol.ts

@@ -385,6 +385,9 @@ export interface CatalogFirm {
      *  by root, for every account type (absent = no limit beyond the type's
      *  max contracts). */
     instrumentLimits?: Record<string, number>;
+    /** The firm's website ('' = none; absent from older masters). The master
+     *  matches the extension's tab against it to find a person's 2FA code. */
+    siteUrl?: string;
     /** Older masters' way to exclude roots; newer ones derive it from
      *  `instruments`. */
     bannedSymbols: string[];