Harden loopback HTTP and document AMO unlisted signing.

README.md

@@ -36,7 +36,7 @@ Firefox will not let an outside process talk to Places. Editing `places.sqlite`
    - **Load Temporary Add-on**
    - pick `extension\manifest.json`
 
-   Permanent install later = AMO-signed (unlisted is enough).
+   Permanent install: Mozilla-signed `.xpi` — [docs/signing.md](docs/signing.md). Start with `--channel=unlisted`.
 
 3. Leave Firefox open. The extension starts the host; `GET http://127.0.0.1:17634/health` should return JSON.
 
@@ -52,9 +52,10 @@ See [AGENTS.md](AGENTS.md) for the method list, HTTP surface, and failure modes.
 
 ## Security
 
-- Binds **127.0.0.1 only**.
+- Binds **127.0.0.1 only**. Browser `Origin` headers are rejected; `Host` must be loopback.
 - Every mutating call (and most reads) needs `Authorization: Bearer <token>`.
-- Only the methods in `extension/background.js` `ALLOWED` run. No history, cookies, or tabs in v0.1.
+- Only the methods in `extension/background.js` `ALLOWED` run. No history, cookies, tabs, or `onMessageExternal` in v0.1.
+- Another add-on with `bookmarks` already has Places; this bridge does not give it a new path in. Same-user processes that steal the token do — that is the agent contract.
 
 ## License