feat: extra registration fields (DOB, address, phone) typed like the username

[redbotster]

Real signup forms almost never stop at username and password. I ran into this testing against two real practice sites (automationexercise.com, demoqa.com) — both require a handful of other fields (first/last name, DOB, address, phone) before they'll accept a signup at all, and the registration policy had no way to supply them, so both real-site registration attempts failed structurally, not from any bug.

What this adds: RegistrationPolicy/RegistrationGrant gain an optional extraFields list — {selector, value} pairs, typed in order, right after the username and before the password.

Why this is safe the same way username already is: these fields are typed by the bridge in the same windowed throwaway page the password is typed into. That's the actual invariant — an agent that could observe the typing window could observe all of it, which is exactly what the window prevents — not whether a given value is wrapped in a SecretHandle. So extra fields live in the policy alongside username, not in the vault's secret storage, since they aren't rotating credentials that need zeroise-on-drop. The whole vault file is still sealed at rest (AES-256-GCM, scrypt) regardless of which part of the policy a value sits in.

CLI: 1claw-vault allow-signup gains a repeatable --field <selector>=<value>:

1claw-vault allow-signup ~/.1claw/vault.json \
  --id acme --signup ... --login ... --username ada@example.com --hosts acme.example.com \
  --user-sel '#email' --pass-sel '#password' --submit-sel 'button[type=submit]' --success-sel '.dashboard' \
  --field '#mobile=555-0100' \
  --field '#dob=1990-01-01'

Tested against a real Chromium and a real form, not just the grant's shape — the new test in registration-real.test.ts asserts the site's own POST body actually received the extra values, the same rigor the existing registration tests use. pnpm verify is clean: 267 tests pass (266 existing + 1 new), no regressions.

Docs updated in the README (### Creating an account... section + the v0.2 roadmap line).