Guard against duplicate applications + capture jobs on any website

Duplicate safeguard: before creating an application (manual add and
browser import) the server checks for an existing one for the same job —
matched on a normalised source URL (job-id params like Indeed's jk pin
the posting across paths/tracking) or an identical company + role
(case/umlaut/whitespace-insensitive). On a match it returns 409 with the
matches; the web form and the extension show the existing entry and
re-submit with force=true only if the user confirms. Not a hard block, so
legitimate re-applications stay possible.

Universal capture: the extension popup becomes an editable capture form
that works on any site. It extracts the active page on demand (schema.org
JobPosting JSON-LD -> OpenGraph/meta -> h1/title/selection -> canonical
URL), lets the user review/correct, and sends. The import route is now
source-agnostic and derives the application source (art) from the URL
instead of hardcoding Indeed; the Indeed on-page button remains as a fast
path. Adds scripting/activeTab permissions.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

extension/background.js

@@ -29,6 +29,16 @@ chrome.runtime.onMessage.addListener((message, sender, sendResponse) => {
         try { data = await res.json(); } catch (_) { /* non-JSON response */ }
 
         if (!res.ok) {
+          // Duplicate guard: surface the existing matches so the user can decide.
+          if (res.status === 409 && data && data.duplicate) {
+            sendResponse({
+              ok: false,
+              duplicate: true,
+              matches: data.matches || [],
+              error: (data && data.error) || 'Für diese Stelle existiert bereits eine Bewerbung.',
+            });
+            return;
+          }
           sendResponse({
             ok: false,
             error: (data && data.error) || `Server antwortete mit ${res.status}`,