fix: derive the model maxlength and document the frame-focus cases

maxlength was hard-coded to 200 in the markup while MAX_MODEL_CHARS lives
in lib/defaults.js; lowering the constant would have left the input
accepting values mergeSettings() silently discards. It is now set from the
constant at render time.

Also records the hasFocus() gate's four manual frame cases in AGENTS.md,
including the findbar trade-off, and notes that fitToBudget()'s budget
guarantee assumes mergeSettings-validated input.

AGENTS.md

@@ -50,10 +50,21 @@ After `npm test`, use `npm run dev` and confirm:
   in both light and dark themes and at a narrow window width, and values
   persist across a restart.
 - The right-click **Ask ChatGPT** item appears only when text is selected.
-- `Alt+Shift+G` acts on the selection, including a selection inside an iframe,
-  and opens a blank chat when nothing is selected or on a restricted page such
-  as `about:config`. Press the key to test this — `commands.getAll()` reports a
-  shortcut as registered even when Firefox has silently overridden it.
+- `Alt+Shift+G` acts on the selection and opens a blank chat when nothing is
+  selected or on a restricted page such as `about:config`. Press the key to test
+  this — `commands.getAll()` reports a shortcut as registered even when Firefox
+  has silently overridden it. The injected snippet is gated on
+  `document.hasFocus()`, so cover all four frame cases:
+  - Select in the top frame → the top-frame text arrives.
+  - Select inside an iframe → the iframe text arrives.
+  - Select in the top frame, *then* select inside an iframe → the iframe text
+    arrives. `hasFocus()` is true for a focused frame and all its ancestors, so
+    if the stale top-frame text arrives instead, exclude ancestors by also
+    checking that `document.activeElement` is not the frame element.
+  - Press `Ctrl+F`, find a term, then press the shortcut without clicking back
+    into the page → a blank chat is expected. Firefox leaves focus in the
+    findbar, so no content frame reports focus. This is a deliberate trade: a
+    stale cross-origin frame silently seeding the prompt was the worse failure.
 
 Inspect ZIP contents whenever packaging rules or assets change; `test/` and
 `docs/` must never appear, not even as empty directory entries.