feat(addon): build & test the add-on locally as a system add-on

[aaspinwall]

What changed?

Adds a supported workflow to build the add-on locally as the system / built-in add-on (the privileged form that ships vendored in comm-central as thundermail), plus a :local variant that wires that build to a locally running Send backend.

• System build tooling (WIP build locally commit): build:dev:system, sync:builtin, dev:builtin scripts; scripts/build.sh rewrites the built dist/manifest.json to the system id (scripts/set-system-id.ts, with --allow-stage for dev builds) and scripts/sync-to-builtin.sh rsyncs the build into a comm-central checkout's built-in location. Unit tests for set-system-id.
• Local-backend variant (feat(addon): build the system add-on against a local backend commit): build:dev:system:local / sync:builtin:local / dev:builtin:local set ADDON_ENV=local, which makes build.sh build in Vite development mode (import.meta.env.MODE === 'development', so the frontend probes the local backend for its storage type and prod Sentry stays off) and force localhost URLs (VITE_SEND_SERVER_URL/CLIENT_URL, stage OIDC) as exported VITE_* vars — which Vite's loadEnv prioritizes over the .env prod block. Each is overridable inline for different local ports.
• README documents the full workflow, notes that CORS already works (the Send backend auto-allows moz-extension:// origins, and the built-in add-on still runs under such an origin), and gives three ways to get past the tls-dev-proxy self-signed cert.

AI disclosure: Written by an AI agent (Claude) working interactively with the author, who directed the approach, verified the build end-to-end (system id + baked localhost URLs), confirmed it runs in Thunderbird against the local Docker stack, and reviewed every change. The WIP build locally base commit is the author's prior work.

Why?

Resolves the gap described in #947: the existing scripts (build, build:dev, deploy-xpi) only emit an XPI for temporary/regular installation, so the system-add-on code path (different privileges, built-in location, system-id shadowing) couldn't be reproduced or debugged locally. The :local variant additionally lets that system build talk to a local Send backend for full end-to-end testing.

Limitations and Notes

• The Send dev stack serves https://localhost:8088 via a self-signed cert. Thunderbird's extension fetch can't skip validation, so an untrusted cert surfaces as a misleading CORS request did not succeed / Status: (null). The README covers three fixes: OS-level trust + security.enterprise_roots.enabled (recommended, survives --temp-profile), a persistent-profile cert exception, or targeting the plain-HTTP backend on :8080 (works with --temp-profile but breaks wss uploads).
• Local auth defaults to the stage IdP (auth-stage.tb.pro) since there's typically no local Keycloak; override VITE_OIDC_ROOT_URL if you run one.

Applicable Issues

Closes #947

Screenshots

N/A — build tooling / developer workflow.