feat(import): bookmarklet for store pages

README.md

@@ -49,6 +49,14 @@ To Be Played is split into three repositories:
   status, seconds). Store and platform names become IGDB abbreviations (`platformFromNames`); an unknown one stays
   empty and the review preselects. **Unverified:** each format is built from the exporter's public source, not from
   a real file; the test files in `src/test/fixtures/import` are made up.
+- **Store pages** (tab "Store page", `src/utils/storeList.js`): a bookmarklet for PlayStation
+  (`library.playstation.com`), Xbox (`www.xbox.com`), Nintendo eShop (`ec.nintendo.com`), Epic Games
+  (`www.epicgames.com`) and GOG (`www.gog.com`). On the store page it reads the user's games with the page's own
+  login and opens `/import#data=...` with at most 1000 titles and platforms. Firefox blocks bookmarklets on pages
+  with a strict Content Security Policy, so the same code can be copied and pasted in the browser console. Xbox has
+  no JSON without its own tokens: it reads the game links shown on the page and is the most likely to break.
+  Nintendo lists purchases only, no free games. **Unverified:** each reader follows the site's JSON as public
+  scripts use it, not a real account.
 - **Platform everywhere**: each game shows its platform ("Steam" for Steam games). The favorite platform from the
   settings is preselected when a game is on it; otherwise a game on one platform gets that one, and a game on
   several waits for the user's pick.
@@ -126,6 +134,7 @@ flowchart LR
     Core --> Speedrun["speedrun.com API"]
     Browser -.->|"game art"| Images["Steam and IGDB image hosts"]
     Browser -.->|"Sign in through Steam"| SteamLogin["steamcommunity.com (OpenID)"]
+    Browser -.->|"bookmarklet, the user's login"| Stores["PlayStation, Xbox, Nintendo, Epic, GOG"]
     Auth -->|"check_authentication"| SteamLogin
 ```
 
@@ -151,6 +160,9 @@ flowchart LR
 - `src/utils/brokenImages.js` reports pictures that fail to load (`GameCover`, achievement icons on the game
   detail page) to Core.
 - `useLibrarySync` polls Core's `/api/library/sync-status` while a Steam sync runs, then loads the data again.
+- The bookmarklet hands its list over in the URL fragment (base64url JSON), which the browser sends to no server.
+  The import page reads it once and removes it from the URL. `RequireSession` keeps the fragment on the way
+  through the login page.
 - The import page polls a running import every 2 s. After a `5xx` or a network error it waits twice as long (up to
   30 s) and gives up after 10 failures in a row; a hidden tab does not poll.
 - All `localStorage` access goes through `src/utils/storage.js`: with site data blocked a read is `null` and a