fix: address post-merge review findings

[esokullu]

Summary

Follow-up to the post-merge review of #2719, #2720, #2721, #2723, #2726, and #2727.

• move the default-on tab-grouping preference into Settings > General > Advanced in Chrome and Firefox
• replace Firefox-reserved shortcut defaults and scope relayed shortcut commands to the originating browser window
• serialize Cloudflare tab cleanup behind pending challenge-state writes so stale session state cannot be restored
• enforce the coupon-source response limit while streaming instead of buffering an oversized body first
• add regressions for each issue

The tab-grouping behavior and default remain unchanged; only the setting location changes.

Validation

• npm test — 33 toolbar-guard tests, 1,589 core tests, and 60 security checks passed
• npm run test:ci — 14 CI scenarios and cloud-capture test passed
• git diff --check
• syntax checks for all changed JavaScript modules

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
webbrain	Ready	Preview	Aug 10, 2026 5:57pm