feat: add Duck Token input field, fix API headers

- Add Duck Token input in sidepanel for direct paste (no page needed)
- Fix generateDuckEmailViaApi headers: remove Content-Type, add
  Origin/Referer to match working curl request
- Token persisted and restored across sessions

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

background.js

@@ -636,6 +636,7 @@ async function handleMessage(message, sender) {
       if (message.payload.customPassword !== undefined) updates.customPassword = message.payload.customPassword;
       if (message.payload.mailProvider !== undefined) updates.mailProvider = message.payload.mailProvider;
       if (message.payload.tempApiUrl !== undefined) updates.tempApiUrl = message.payload.tempApiUrl;
+      if (message.payload.duckToken !== undefined) updates.duckToken = message.payload.duckToken;
       if (message.payload.inbucketHost !== undefined) updates.inbucketHost = message.payload.inbucketHost;
       if (message.payload.inbucketMailbox !== undefined) updates.inbucketMailbox = message.payload.inbucketMailbox;
       await setState(updates);
@@ -895,7 +896,8 @@ async function generateDuckEmailViaApi(token) {
     method: 'POST',
     headers: {
       'Authorization': `Bearer ${token}`,
-      'Content-Type': 'application/json',
+      'Origin': 'https://duckduckgo.com',
+      'Referer': 'https://duckduckgo.com/',
     },
   });
   if (!resp.ok) {

sidepanel/sidepanel.html

@@ -69,6 +69,10 @@
         <span class="data-label">Mailbox</span>
         <input type="text" id="input-inbucket-mailbox" class="data-input" placeholder="e.g. zju2001" />
       </div>
+      <div class="data-row">
+        <span class="data-label">Duck Token</span>
+        <input type="text" id="input-duck-token" class="data-input" placeholder="Paste DuckDuckGo access_token (auto-extracted if empty)" />
+      </div>
       <div class="data-row">
         <span class="data-label">Email</span>
         <div class="data-inline">

sidepanel/sidepanel.js

@@ -32,6 +32,7 @@ const rowInbucketHost = document.getElementById('row-inbucket-host');
 const inputInbucketHost = document.getElementById('input-inbucket-host');
 const rowInbucketMailbox = document.getElementById('row-inbucket-mailbox');
 const inputInbucketMailbox = document.getElementById('input-inbucket-mailbox');
+const inputDuckToken = document.getElementById('input-duck-token');
 const inputRunCount = document.getElementById('input-run-count');
 
 // ============================================================
@@ -95,6 +96,9 @@ async function restoreState() {
     if (state.tempApiUrl) {
       inputTempApiUrl.value = state.tempApiUrl;
     }
+    if (state.duckToken) {
+      inputDuckToken.value = state.duckToken;
+    }
     if (state.inbucketHost) {
       inputInbucketHost.value = state.inbucketHost;
     }
@@ -437,6 +441,13 @@ for (const evt of ['change', 'input']) {
       payload: { tempApiUrl: inputTempApiUrl.value.trim() },
     });
   });
+  inputDuckToken.addEventListener(evt, async () => {
+    await chrome.runtime.sendMessage({
+      type: 'SAVE_SETTING',
+      source: 'sidepanel',
+      payload: { duckToken: inputDuckToken.value.trim() },
+    });
+  });
 }
 
 inputInbucketHost.addEventListener('change', async () => {