Fix bookmarklet: scrape same-origin pages instead of calling the API

Root-caused both remaining failures against the real, public depop.com
(no login needed - shop and product pages are publicly viewable):

- webapi.depop.com has no CORS allowance for cross-origin fetches from
  www.depop.com (confirmed via browser console: "blocked by CORS
  policy, no Access-Control-Allow-Origin header"), so a direct fetch
  to that API can never work from a page script, real browser or not.
- Replaced it with scraping the already-rendered shop grid (product
  links + prices) plus a same-origin fetch() to each product's own
  page (no CORS involved at all, same depop.com origin), parsed with
  DOMParser for title/description/brand/price/photos.
- Dropped target="_blank" on the result form submit - it fires from
  an async Promise callback, not synchronously from the click, so
  real popup blockers are likely to block it. Same-tab navigation
  sidesteps that entirely.
- Filtered product photos to the /P<n>.jpg filename pattern - the
  seller's own profile avatar (/U<n>.jpg) was being swept in by the
  "images before the price node" heuristic.

Verified end-to-end against a real, live public shop page (24 real
listings, correct titles/prices/brands/photos) using the browser tool
navigated to www.depop.com directly - not a mock.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>