extension: manifest.json missing webRequest permission — headers never captured

[dxh2723192626]

Summary

extension/manifest.json does not declare the webRequest permission, so the extension cannot observe any request headers on jobs.bytedance.com (or any other ATS host). This breaks session capture at the source — the cookie-jar / header-sniffing path silently produces nothing.

Repro

1. Install the extension as-is from extension/.
2. Log into jobs.bytedance.com, navigate to a job, click apply.
3. Inspect the extension's captured data — no authorization / x-csrf-token / cookie headers are recorded.

Expected

Manifest declares webRequest (and webRequestExtraHeaders where needed for Cookie / Authorization on MV3) so chrome.webRequest.onBeforeSendHeaders actually fires.

Notes

Found while trying to capture ~/.jobpro/bytedance.session.json for the Feishu 3-step apply flow.