feat(v1.4.0): CSV/Excel/JSON/NextUp exports + hybrid smart year standing

- Export modules (export-csv/json/xlsx) mirroring the PDF layout, plus a
  Next Up import CSV matching the raycast/nextup column contract.
- Hybrid Year Level: View Grades history (exact per-semester standing),
  falling back to units math (prospectus total - lacking), then profile.
  Popup adds a year-mode setting (auto/custom/off).
- On-page button row now offers PDF / CSV / Excel / JSON / Next Up.
- Bump version to 1.4.0.
- Tag-only build workflow with an optional AMO sign step for a signed .xpi;
  separate ci.yml keeps tests on pushes/PRs.
- Tests: year-standing parser tests + export tests (CSV quoting, JSON schema,
  XLSX structure); CI validates XLSX via openpyxl.

.gitea/workflows/build.yml

@@ -1,10 +1,9 @@
 name: build-extension
 
+# Build + release only on version tags. Daily dev/test runs live in ci.yml.
 on:
   push:
-    branches: [feat/ismis-helper, prod]
     tags: ['v*']
-  pull_request:
 
 # Ensure the job token can create releases and upload assets.
 permissions:
@@ -26,27 +25,37 @@ jobs:
       - name: Install dev dependencies
         run: npm ci || npm install
 
-      - name: Install PyMuPDF (PDF text assertions)
+      - name: Install PyMuPDF + openpyxl (PDF text + XLSX validation)
         run: |
           python3 -m venv /tmp/venv
-          /tmp/venv/bin/pip install --quiet pymupdf
+          /tmp/venv/bin/pip install --quiet pymupdf openpyxl
           echo "/tmp/venv/bin" >> "$GITHUB_PATH"
 
       - name: Run tests
         run: npm test
 
+      - name: Validate exports open in real readers
+        run: node scripts/validate-exports.js
+
       - name: Build both variants
         run: node scripts/build.js all
 
-      - name: Upload zip artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: ismis-helper-zips
-          path: dist/*.zip
-          if-no-files-found: error
+      - name: Sign Firefox build (xpi for permanent install)
+        # Optional: only runs when the AMO credentials exist as repo secrets.
+        # Signing requires a version AMO has not seen before — bump
+        # manifest.json before tagging (1.2.0 and 1.3.0 are already on AMO).
+        if: env.AMO_JWT_ISSUER != '' && env.AMO_JWT_SECRET != ''
+        env:
+          AMO_JWT_ISSUER: ${{ secrets.AMO_JWT_ISSUER }}
+          AMO_JWT_SECRET: ${{ secrets.AMO_JWT_SECRET }}
+        run: |
+          set -euo pipefail
+          npm run sign
+          XPI=$(ls dist/*.xpi | head -1)
+          VERSION=$(node -p "require('./dist/firefox/manifest.json').version")
+          mv "$XPI" "dist/ismis-helper-${VERSION}-an+fx.xpi"
 
-      - name: Publish release on version tag
-        if: startsWith(github.ref, 'refs/tags/v')
+      - name: Publish release
         # Gitea-native release: softprops/action-gh-release targets GitHub's API
         # and fails on Gitea (405). Instead we call the Gitea API directly with
         # the runner-provided GITHUB_TOKEN and GITHUB_API_URL.
@@ -64,10 +73,11 @@ jobs:
             -d "{\"tag_name\":\"${TAG}\",\"name\":\"${TAG}\",\"body\":\"ISMIS Helper ${TAG}\"}" \
             "${API}/repos/${REPO}/releases")
           RELEASE_ID=$(echo "${RELEASE_JSON}" | python3 -c "import sys,json; print(json.load(sys.stdin)['id'])")
-          # Attach both zips as release assets
-          for f in dist/*.zip; do
+          # Attach zips and the signed xpi (if present) as release assets
+          for f in dist/*.zip dist/*.xpi; do
+            [ -f "$f" ] || continue
             curl -sS -X POST \
               -H "Authorization: token ${GITHUB_TOKEN}" \
               -F "attachment=@${f}" \
               "${API}/repos/${REPO}/releases/${RELEASE_ID}/assets?name=$(basename "${f}")"
-          done
+          done

.gitea/workflows/ci.yml

@@ -0,0 +1,35 @@
+name: ci
+
+# Fast test feedback on daily development. No builds, no releases — those only
+# happen on v* tags via build.yml.
+on:
+  push:
+    branches: [feat/ismis-helper, prod]
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - name: Install dev dependencies
+        run: npm ci || npm install
+
+      - name: Install PyMuPDF + openpyxl (PDF text + XLSX validation)
+        run: |
+          python3 -m venv /tmp/venv
+          /tmp/venv/bin/pip install --quiet pymupdf openpyxl
+          echo "/tmp/venv/bin" >> "$GITHUB_PATH"
+
+      - name: Run tests
+        run: npm test
+
+      - name: Validate exports open in real readers
+        run: node scripts/validate-exports.js