v1.0.11 — Security hardening release

Completes the planned security refactor mentioned in v1.0.10 Notes to
Reviewer. All innerHTML assignments have been eliminated from the
codebase.

Changes:
- Main panel injection now uses DOMParser.parseFromString() (safe,
non-executing HTML parsing API).
- Plain Language overlay rebuilt with createElement() and textContent.
Inline onclick replaced with addEventListener().
- Reading Companion word spans rebuilt with createElement(). Syllable
separator rendered as a styled child span.
- SVG colour-blindness filter rebuilt with createElementNS() for defs,
filter, and feColorMatrix elements.
- Dead document. body.innerHTML cache reads removed.
- Empty-string innerHTML clearings replaced with DOM removeChild loops.
- popup.html inline <script> moved to external popup.js file,
satisfying Firefox default CSP for extension pages.

Verified: grep ".innerHTML\s=" .js returns zero matches across all
JavaScript files.

No user-facing feature changes. This is a security compliance release
only.