add host permissions for ATlast API servers

Fix CORS blocking extension health checks and API calls:
- Add http://127.0.0.1:8888/* (dev)
- Add http://localhost:8888/* (alt dev)
- Add https://atlast.byarielm.fyi/* (prod)

Extension can now make requests to ATlast servers without
CORS errors.

packages/extension/manifest.json

···
   ],
   "host_permissions": [
     "https://twitter.com/*",
-    "https://x.com/*"
+    "https://x.com/*",
+    "http://127.0.0.1:8888/*",
+    "http://localhost:8888/*",
+    "https://atlast.byarielm.fyi/*"
   ],
   "background": {
     "service_worker": "background/service-worker.js",