feat: Extensions settings tab + capture dialog redesign with Advanced options

Settings/Extensions tab (admin-only):
- New 'Extensions' tab between Cookies and Storage
- ExtensionsTab component: shows uBlock Origin Lite card with pill toggle
- Reads ublock_enabled from instance settings; patch via existing PATCH endpoint
- Shows ublock_ext_available status from server (whether ARCHIVR_UBLOCK_EXT is set)

Instance settings:
- Add ublock_enabled BOOLEAN (default true) to instance_settings auth DB table
- Idempotent ALTER TABLE migration in initialize_auth_schema()
- get/update_instance_settings include ublock_enabled
- GET /api/admin/instance-settings now also returns ublock_ext_available (computed
  from ARCHIVR_UBLOCK_EXT env var at request time)
- PATCH /api/admin/instance-settings accepts ublock_enabled

Per-capture override:
- CaptureBody gains ublock_enabled: Option<bool>
- CaptureConfig gains ublock_enabled: Option<bool>
- singlefile::save() gains ublock_enabled_override: Option<bool> param
- Capture handler resolves: body override > global instance setting > env var
- submitCapture(aid, loc, qual, extensions) in api.js passes ublock_enabled

Capture dialog redesign:
- Archive button: full-width, 13px padding, min-width 220px, primary CTA
- Cancel: full-width but text-style, below Archive
- ‹Advanced options› chevron toggle (rotates on open)
- Expanded panel shows uBlock toggle for this capture session
- Loads global ublock_enabled default from instance settings on mount

Styles:
- .ext-toggle pill switch (44×24 and 36×20 small variant)
- .ext-card for Settings Extensions tab
- .capture-advanced + .capture-advanced-panel + .capture-chevron
- .capture-ext-row / .capture-ext-label / .capture-ext-name / .capture-ext-desc
- .form-hint utility class

crates/archivr-core/src/database.rs

@@ -137,6 +137,9 @@ pub struct InstanceSettings {
     pub public_entry_content_enabled: bool,
     pub open_registration_enabled: bool,  // maps to public_archive_submission_enabled column
     pub default_entry_visibility: u32,
+    /// Global default for ad-blocking via uBlock Origin Lite during WebPage captures.
+    /// Per-capture requests can override this.
+    pub ublock_enabled: bool,
 }
 
 #[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]
@@ -460,13 +463,14 @@ pub fn initialize_auth_schema(conn: &Connection) -> Result<()> {
             public_index_enabled               INTEGER NOT NULL DEFAULT 0 CHECK (public_index_enabled IN (0, 1)),
             public_entry_content_enabled       INTEGER NOT NULL DEFAULT 0 CHECK (public_entry_content_enabled IN (0, 1)),
             public_archive_submission_enabled  INTEGER NOT NULL DEFAULT 0 CHECK (public_archive_submission_enabled IN (0, 1)),
-            default_entry_visibility           INTEGER NOT NULL DEFAULT 2
+            default_entry_visibility           INTEGER NOT NULL DEFAULT 2,
+            ublock_enabled                     INTEGER NOT NULL DEFAULT 1 CHECK (ublock_enabled IN (0, 1))
         );
 
         INSERT OR IGNORE INTO instance_settings
             (id, public_index_enabled, public_entry_content_enabled,
-             public_archive_submission_enabled, default_entry_visibility)
-        VALUES (1, 0, 0, 0, 2);
+             public_archive_submission_enabled, default_entry_visibility, ublock_enabled)
+        VALUES (1, 0, 0, 0, 2, 1);
 
         CREATE TABLE IF NOT EXISTS users (
             id            INTEGER PRIMARY KEY,
@@ -500,6 +504,12 @@ pub fn initialize_auth_schema(conn: &Connection) -> Result<()> {
         [],
     );
 
+    // Add ublock_enabled column to instance_settings if not present (idempotent migration)
+    let _ = conn.execute(
+        "ALTER TABLE instance_settings ADD COLUMN ublock_enabled INTEGER NOT NULL DEFAULT 1",
+        [],
+    );
+
     Ok(())
 }
 
@@ -724,7 +734,8 @@ pub fn list_user_tokens(conn: &Connection, user_id: i64) -> Result<Vec<ApiTokenR
 pub fn get_instance_settings(conn: &Connection) -> Result<InstanceSettings> {
     conn.query_row(
         "SELECT public_index_enabled, public_entry_content_enabled,
-                public_archive_submission_enabled, default_entry_visibility
+                public_archive_submission_enabled, default_entry_visibility,
+                COALESCE(ublock_enabled, 1)
          FROM instance_settings WHERE id = 1",
         [],
         |row| {
@@ -733,6 +744,7 @@ pub fn get_instance_settings(conn: &Connection) -> Result<InstanceSettings> {
                 public_entry_content_enabled: row.get::<_, i64>(1)? != 0,
                 open_registration_enabled: row.get::<_, i64>(2)? != 0,
                 default_entry_visibility: row.get::<_, i64>(3)? as u32,
+                ublock_enabled: row.get::<_, i64>(4)? != 0,
             })
         },
     )
@@ -745,13 +757,15 @@ pub fn update_instance_settings(conn: &Connection, settings: &InstanceSettings)
          SET public_index_enabled = ?1,
              public_entry_content_enabled = ?2,
              public_archive_submission_enabled = ?3,
-             default_entry_visibility = ?4
+             default_entry_visibility = ?4,
+             ublock_enabled = ?5
          WHERE id = 1",
         params![
             settings.public_index_enabled as i64,
             settings.public_entry_content_enabled as i64,
             settings.open_registration_enabled as i64,
             settings.default_entry_visibility as i64,
+            settings.ublock_enabled as i64,
         ],
     )?;
     Ok(())