Type the save-prompt captured-input response without suppression #534

Context

web-extension/src/content-script/renderSaveCredentialsForm.tsx passes the
result of trpc.getCapturedInputEvents.query() to PromptPassword under an
@ts-expect-error. The RPC can return inputsUrl as string | undefined
because the browser sender may not have a tab URL, while the component prop is
declared as a required string. PromptPassword currently only consumes the
captured events.

Goal

Model the missing-tab-URL case explicitly and remove the TypeScript
suppression. Keep the existing save-prompt behavior and do not invent a URL.

Acceptance criteria

• Remove the @ts-expect-error in renderSaveCredentialsForm.tsx.
• Make the RPC result and component prop agree through an explicit typed
  design. Valid options include normalizing the URL at the RPC boundary when a
  real fallback exists, making it optional where it is genuinely optional, or
  removing the unused field from the component prop.
• Do not use any, a double cast, or a non-null assertion to hide the missing
  case.
• Add or update a focused test covering a response whose sender has no tab URL.
• Preserve the captured-input events passed to addLoginCredentials.
• pnpm --dir web-extension tsc and the focused test pass.

This task uses synthetic data only and does not require a browser-store account,
production secrets, or real credentials.