fix(extension): make captcha and token capture work on flow.google.com

[santoshray02]

Summary

Generation had been failing for a week with CAPTCHA_FAILED: CONTENT_TIMEOUT while /health kept reporting healthy. Three separate causes, all fallout from the move from labs.google/fx/tools/flow to flow.google.com:

1. The Flow bearer is only observable during the labs.google → flow.google.com handoff. Reloading a flow.google.com tab never re-captures it, so the token was never obtained (has_flow_key: false) and could never refresh. Token refresh now drives an extension-owned tab through TOKEN_URL.
2. reCAPTCHA Enterprise is only loaded on /project/<id> pages, never on the home page the old FLOW_URL now redirects to. On-demand tabs open the request's projectId (or the last project page seen), and project tabs are preferred over other Flow tabs.
3. The first tab matching a Flow URL was used blindly. A tab with a dead bridge (opened before an extension reload, or one that never loaded injected.js) swallowed GET_CAPTCHA for 25 s. Tabs are now pinged (PING_BRIDGE → FLOW_AGENT_PING/PONG) before use and skipped if they do not answer.

Hardening found necessary while debugging

• Every await on the tab-lookup path is bounded (withTimeout) so one Chrome API call that never settles cannot park the shared getOrOpenFlowTab promise and silently stall every later request.
• GET_CAPTCHA is re-dispatched until injected.js answers (it loads async; a first dispatch could be lost); injected.js dedups by requestId and caps grecaptcha.execute at 15 s.
• The Google API fetch and callback delivery carry timeouts.
• The last 200 [Flow Agent] console lines persist to chrome.storage.local.debugLog so stalls can be diagnosed after the fact.

Verification

• Measured on a live Pro account: grecaptcha.enterprise is present on flow.google.com/project/… and absent on flow.google.com/ (0 recaptcha scripts after 20 s); the bearer was captured only via the labs.google handoff.
• End to end: a 4 s text-to-video clip generated in 88 s through the extension (credits 1050 → 1043, 1280×720 H.264/AAC).
• node --check clean on background.js, content.js, injected.js; tests/test_extension_flow_urls.py (2 new tests) passes.

Related: #10 (captcha/host findings), follows #11.

🤖 Generated with Claude Code

https://claude.ai/code/session_01GkWggBWEKrNTR4B5opZ3bo