Follow-up surfaced during #6 review.

Problem

src/injected.js runs in the content-script isolated world. Headers, Request, and Response constructors in the isolated world are different objects than the ones on the page. So:

• headers instanceof Headers returns false for a Headers object the page created.
• input instanceof Request returns false for a Request the page created.

The page's fetch is actually intercepted by nip98-interceptor.js (which runs in page realm), so the practical impact is limited — the injected.js fetch override only catches content-script-initiated fetches where objects share the isolated-world realm.

But the code is still technically incorrect and could misbehave if, for example, the extension ever intercepts a page-created Request via message passing or starts sharing objects across realms.

Proposed fix

Replace instanceof checks with cross-realm-safe alternatives:

• Duck-typing: typeof headers?.has === 'function' && typeof headers?.get === 'function'
• Or Symbol.toStringTag === 'Headers' / Object.prototype.toString.call(...)

Apply in hasAuthorizationHeader, fetchCallHasAuthorization, setAuthorizationOnOptions, normalizeFetchCall.

Scope note

Not fixing in #6 because that PR is scoped to the auth-overwrite bug and this is a correctness hardening that doesn't currently manifest in practice.