docs(readme): add Permissions subsection under Download with friendly explanations and a simple preamble

README.md

@@ -9,6 +9,20 @@ Grab the latest build from my self-hosted feed at `add-ons.jordanwages.com`:
 **[Download the latest XPI](https://add-ons.jordanwages.com/archive-org-link-grabber/archive-org-link-grabber-latest.xpi)**
 
 
+### Permissions
+
+This add-on asks for only the permissions it truly needs. It runs on archive.org download pages so it can read the list of files, lets you copy links to your clipboard, and can send them to an aria2 server only when you ask. Your settings (including any aria2 secret) stay on your computer in the browser’s local storage. The add-on does not track you or read data on other sites.
+
+- https://archive.org/*: needed to read and parse archive.org download pages. The content script only runs on `https://archive.org/download/*`, and the background uses this to show the tab badge and context menu on those pages.
+- storage: saves your aria2 endpoint/secret and preferences in `browser.storage.local`.
+- clipboardWrite: lets the popup and quick actions copy filtered links to your clipboard when you click Copy.
+- activeTab: allows on‑demand injection of the small collector script into the current tab when you open the popup or use the context menu. It does not run on other sites unless you interact.
+- contextMenus: adds the “Collect links…” entry and dynamic quick actions (“Download/Copy All” and top file types) to the page context menu on archive.org pages.
+- Host permissions for aria2 RPC endpoints:
+  - http://localhost:6800/* and https://localhost:6800/*: defaults for local aria2 instances.
+  - http://*/* and https://*/*: enables connecting to non‑local aria2 endpoints you configure in Options. No network request is made unless you click Send or Test; your secret stays in extension storage, and RPC calls originate from the background script.
+
+
 ---
 
 ## Features