fix: replace postMessage wildcard '*' with window.location.origin

All 18 window.postMessage(..., '*') calls across the codebase now
use window.location.origin as the targetOrigin:

- src/utils/extensionProxy.ts: EXTENSION_REQUEST message
- extension/Chrome/injected.js: 4 message helpers (extract, extractAll, detect, setupHeaders)
- extension/Chrome/content.js: 4 response forwards (error/success/catch + EXTRACTION_RESULT)
- extension/Firefox/injected.js: 4 message helpers (mirror of Chrome)
- extension/Firefox/content.js: 4 response forwards (mirror of Chrome)
- userscript/movix.user.js: postExtensionResponse call

This prevents any cross-origin script (iframe, rogue extension, etc.)
from intercepting Movix extension messages.

extension/Chrome/content.js

@@ -26,14 +26,14 @@ window.addEventListener("message", async (event) => {
                     messageId,
                     success: false,
                     error: response.error
-                }, "*");
+                }, window.location.origin);
             } else {
                 window.postMessage({
                     source: "MOVIX_EXTENSION",
                     messageId,
                     success: true,
                     data: response
-                }, "*");
+                }, window.location.origin);
             }
         } catch (error) {
             window.postMessage({
@@ -41,7 +41,7 @@ window.addEventListener("message", async (event) => {
                 messageId,
                 success: false,
                 error: error.message
-            }, "*");
+            }, window.location.origin);
         }
     }
 });
@@ -55,6 +55,6 @@ chrome.runtime.onMessage.addListener((message, sender, sendResponse) => {
             source: 'MOVIX_EXTENSION',
             type: 'EXTRACTION_RESULT',
             data: message.data
-        }, '*');
+        }, window.location.origin);
     }
 });

extension/Chrome/injected.js

@@ -38,7 +38,7 @@ window.movixExtractM3u8 = function(type, url) {
             action: 'EXTRACT_M3U8',
             messageId,
             payload: { type, url }
-        }, '*');
+        }, window.location.origin);
     });
 };
 
@@ -77,7 +77,7 @@ window.movixExtractAllM3u8 = function(sources) {
             action: 'EXTRACT_ALL_M3U8',
             messageId,
             payload: { sources }
-        }, '*');
+        }, window.location.origin);
     });
 };
 
@@ -106,7 +106,7 @@ window.movixDetectEmbeds = function(sources) {
             action: 'DETECT_EMBEDS',
             messageId,
             payload: { sources }
-        }, '*');
+        }, window.location.origin);
     });
 };
 
@@ -134,6 +134,6 @@ window.movixSetupHeaders = function(type, url) {
             action: 'SETUP_HEADERS',
             messageId,
             payload: { type, url }
-        }, '*');
+        }, window.location.origin);
     });
 };

extension/Firefox/content.js

@@ -29,14 +29,14 @@ window.addEventListener("message", async (event) => {
                     messageId,
                     success: false,
                     error: response.error
-                }, "*");
+                }, window.location.origin);
             } else {
                 window.postMessage({
                     source: "MOVIX_EXTENSION",
                     messageId,
                     success: true,
                     data: response
-                }, "*");
+                }, window.location.origin);
             }
         } catch (error) {
             window.postMessage({
@@ -44,7 +44,7 @@ window.addEventListener("message", async (event) => {
                 messageId,
                 success: false,
                 error: error.message
-            }, "*");
+            }, window.location.origin);
         }
     }
 });
@@ -57,6 +57,6 @@ browserAPI.runtime.onMessage.addListener((message, sender, sendResponse) => {
             source: 'MOVIX_EXTENSION',
             type: 'EXTRACTION_RESULT',
             data: message.data
-        }, '*');
+        }, window.location.origin);
     }
 });

extension/Firefox/injected.js

@@ -38,7 +38,7 @@ window.movixExtractM3u8 = function(type, url) {
             action: 'EXTRACT_M3U8',
             messageId,
             payload: { type, url }
-        }, '*');
+        }, window.location.origin);
     });
 };
 
@@ -77,7 +77,7 @@ window.movixExtractAllM3u8 = function(sources) {
             action: 'EXTRACT_ALL_M3U8',
             messageId,
             payload: { sources }
-        }, '*');
+        }, window.location.origin);
     });
 };
 
@@ -106,7 +106,7 @@ window.movixDetectEmbeds = function(sources) {
             action: 'DETECT_EMBEDS',
             messageId,
             payload: { sources }
-        }, '*');
+        }, window.location.origin);
     });
 };
 
@@ -134,6 +134,6 @@ window.movixSetupHeaders = function(type, url) {
             action: 'SETUP_HEADERS',
             messageId,
             payload: { type, url }
-        }, '*');
+        }, window.location.origin);
     });
 };

src/utils/extensionProxy.ts

@@ -60,7 +60,7 @@ export const fetchFromExtension = <T = unknown>(
             action,
             payload: enrichedPayload,
             messageId
-        }, "*");
+        }, window.location.origin);
 
         // Timeout after 10 seconds
         setTimeout(() => {

userscript/movix.user.js

@@ -5153,7 +5153,7 @@
                 ? payload.message
                 : payload?.error || String(payload || "Erreur inconnue"),
           },
-      "*",
+      pageWindow.location.origin,
     );
   }