feat: Prompt for optional <all_urls> permission in onboarding and popup

[bartekplus]

As per user feedback, the extension declared `<all_urls>` in the manifest as an `optional_host_permissions`, but this permission was never presented to the user to grant.

This PR introduces the following changes:

• Onboarding Flow: The installation greeting page now actively prompts the user to grant the `<all_urls>` permission.
• Popup UI: If the permission is missing (e.g., skipped during install or revoked later), a red "Action Required" banner appears at the top of the popup menu to let the user know website access is needed.
• E2E Testing: The Puppeteer E2E tests have been updated with a mock of the `browser.permissions.request` API to validate the new onboarding flow's behavior.
• I18n: Added translation keys `popup_permission_required` and `popup_permission_grant` to `i18n.js` for all 9 supported languages.