fix: allow non-local RPC hosts and improve HTTPS-Only guidance

- Add wildcard host permissions for RPC calls
- Surface HTTPS-Only hint in Options test flow
- Update Troubleshooting docs for HTTPS-Only and host perms

manifest.json

@@ -18,7 +18,9 @@
     "contextMenus",
     "https://archive.org/*",
     "http://localhost:6800/*",
-    "https://localhost:6800/*"
+    "https://localhost:6800/*",
+    "http://*/*",
+    "https://*/*"
   ],
   "background": {
     "scripts": [