Document who can call the loopback API and let the user pick the listen port.

extension/options.html

@@ -9,6 +9,12 @@
   <header>
     <h1>Bookmarks API for Scripting and AI</h1>
     <p class="lead">An API add-on for Firefox to allow agentic and script-based management of user bookmarks.</p>
+    <section class="usage">
+      <h2>Who can use this</h2>
+      <p>Tools on <strong>this computer</strong> can call the API — a local script, an editor agent, or a session you opened here (SSH, remote desktop). They need a secret you issue below.</p>
+      <p>It does not work from chatgpt.com or other sites in a browser tab. Those run elsewhere and cannot see this machine’s loopback port. Pages inside Firefox are blocked too.</p>
+      <p class="muted">If this Firefox profile syncs bookmarks with a Mozilla account, changes made here can show up on your other devices. The API itself still only accepts connections on this machine.</p>
+    </section>
     <ol class="process">
       <li>Issue a secret for each agent or script that should be allowed to work with your bookmarks.</li>
       <li>Store that secret with your secrets. This add-on keeps only a hash.</li>
@@ -17,6 +23,16 @@
     <p id="status" class="muted"></p>
   </header>
 
+  <section class="settings">
+    <h2>Listen port</h2>
+    <p class="muted">Loopback only (<code>127.0.0.1</code>). Change this if the default is already in use. Your tools must use the same port.</p>
+    <div class="row">
+      <label class="sr" for="port">Listen port</label>
+      <input id="port" type="number" min="1024" max="65535" step="1" value="17634">
+      <button id="save-port" type="button">Save port</button>
+    </div>
+  </section>
+
   <section class="row">
     <input id="name" type="text" maxlength="64" placeholder="Client name" autocomplete="off">
     <button id="create" type="button">Generate secret</button>