fix: allow non-local RPC hosts and improve HTTPS-Only guidance

- Add wildcard host permissions for RPC calls
- Surface HTTPS-Only hint in Options test flow
- Update Troubleshooting docs for HTTPS-Only and host perms

src/options/index.js

@@ -29,13 +29,38 @@ async function reset() {
 }
 
 async function testConnection() {
-  els.status.textContent = 'Testing…';
+  const endpoint = els.endpoint.value.trim();
+  const secret = els.secret.value.trim();
+
+  // Heads-up for Firefox HTTPS-Only Mode when using non-local HTTP
   try {
-    const res = await getVersion({ endpoint: els.endpoint.value.trim(), secret: els.secret.value.trim() });
+    const u = new URL(endpoint);
+    const isHttp = u.protocol === 'http:';
+    const isLoopback = ['localhost', '127.0.0.1', '[::1]'].includes(u.hostname);
+    if (isHttp && !isLoopback) {
+      els.status.textContent = 'Testing… (note: Firefox HTTPS-Only may upgrade this)';
+    } else {
+      els.status.textContent = 'Testing…';
+    }
+  } catch {
+    els.status.textContent = 'Testing…';
+  }
+  try {
+    const res = await getVersion({ endpoint, secret });
     const version = res?.result?.version || JSON.stringify(res?.result || res);
     els.status.textContent = `OK: aria2 version ${version}`;
   } catch (e) {
-    els.status.textContent = `Error: ${e?.message || e}`;
+    // Provide a more actionable hint when HTTPS-Only likely interferes
+    let hint = '';
+    try {
+      const u = new URL(endpoint);
+      const isHttp = u.protocol === 'http:';
+      const isLoopback = ['localhost', '127.0.0.1', '[::1]'].includes(u.hostname);
+      if (isHttp && !isLoopback) {
+        hint = ' — if Firefox HTTPS-Only Mode is on, use https, add a site exception, or disable HTTPS-Only temporarily.';
+      }
+    } catch {}
+    els.status.textContent = `Error: ${e?.message || e}${hint}`;
   }
 }
 
@@ -49,4 +74,3 @@ document.addEventListener('DOMContentLoaded', async () => {
   wire();
   await restore();
 });
-