Add Vinted -> Depop direction, make the site fully bidirectional

Reconnaissance on real, public Vinted pages (a live closet + item page,
no login needed) found:
- Vinted exposes a <script type="application/ld+json"> Product block
  (name, description, price, brand) plus data-testid="item-attributes-*"
  fields for size/condition - cleaner structured data than Depop, so
  this direction gets size/condition/brand reliably instead of
  best-effort guessing.
- The closet grid is client-rendered only (plain fetch() of the profile
  URL returns 0 item links, confirmed), so the bookmarklet reads it from
  the live DOM first, same as the Depop side already does.
- Same avatar-in-photos bug as Depop showed up here too (a 96x96 image
  wrapped in a link to /member/<id>) - filtered out the same way.

Renamed depop.py -> listings.py and test_depop.py -> test_listings.py
since the format_listing()/parse_shop_response() pipeline is now shared
by both directions, not Depop-specific. Added an explicit "url" field
so format_listing() doesn't have to guess a Depop-shaped URL for
Vinted-sourced items.

app.py now serves two bookmarklets (Depop->Vinted, Vinted->Depop) and
/from-browser takes a target field to label results and route the
"Copy for X" button correctly regardless of direction.

Verified end-to-end against real, live, public pages on both sites
(not mocked) using the browser tool navigated directly to depop.com
and vinted.com.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>