feat: add Firefox extract methods and complete data model fields (#527)

* feat: add Firefox extract methods and complete data model fields

Firefox extract methods:
- extractPasswords: JSON + ASN1PBE decryption via decryptPBE helper
- extractCookies: SQLite, plaintext (no encryption), journalOff
- extractHistories: SQLite, visit count ASC sort (matches old behavior)
- extractDownloads: SQLite, moz_annos JOIN with JSON content parsing
- extractBookmarks: SQLite, moz_bookmarks JOIN moz_places
- extractExtensions: JSON, filter by location=app-profile
- extractLocalStorage: SQLite webappsstore2, reversed originKey parsing

Complete data model fields (union of Chromium and Firefox):
- CookieEntry: add HasExpire, IsPersistent
- DownloadEntry: add MimeType
- CreditCardEntry: add NickName, Address
- ExtensionEntry: add HomepageURL, Enabled

Update Chromium extractors to populate new fields:
- extract_cookie.go: fill HasExpire, IsPersistent
- extract_download.go: SELECT and fill mime_type
- extract_creditcard.go: SELECT nickname, billing_address_id
- extract_extension.go: fill HomepageURL, Enabled (state==1)

Tests:
- Full test coverage for all 7 Firefox extract functions
- Password test uses known ASN1PBE test vectors from crypto package
- Table-driven tests for parseOriginKey
- Updated Chromium tests for new fields

* fix: add COALESCE for nullable bookmark title in Firefox query

Firefox moz_bookmarks.title can be NULL (PR #500 fixed this in old code).
Add COALESCE to handle NULL gracefully in SQL instead of relying on
driver-specific NULL→string conversion behavior.

* fix: enable journalOff for all Firefox SQLite extractors and populate cookie flags

- Set journalOff=true for extract_history, extract_download, extract_bookmark
  (Firefox databases require PRAGMA journal_mode=off to avoid lock errors)
- Populate HasExpire and IsPersistent for Firefox cookies (derived from expiry>0)
- Add test assertions for HasExpire/IsPersistent in both Chromium and Firefox

browser/firefox/extract_password_test.go

@@ -0,0 +1,106 @@
+package firefox
+
+import (
+	"bytes"
+	"encoding/base64"
+	"encoding/hex"
+	"fmt"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// These values are from crypto/asn1pbe_test.go loginPBETestCases.
+// loginPBE hex decrypts to "Hello, World!" with globalSalt = "moond4rk" * 3.
+const loginPBEHex = "303b0410f8000000000000000000000000000001301506092a864886f70d010503040830313233343536370410fe968b6565149114ea688defd6683e45"
+
+var testGlobalSalt = bytes.Repeat([]byte("moond4rk"), 3) // 24 bytes
+
+func loginPBEBase64(t *testing.T) string {
+	t.Helper()
+	raw, err := hex.DecodeString(loginPBEHex)
+	require.NoError(t, err)
+	return base64.StdEncoding.EncodeToString(raw)
+}
+
+func TestExtractPasswords(t *testing.T) {
+	encB64 := loginPBEBase64(t)
+
+	// Construct a logins.json with known encrypted username/password
+	json := fmt.Sprintf(`{
+		"logins": [
+			{
+				"hostname": "https://example.com",
+				"formSubmitURL": "https://example.com/login",
+				"encryptedUsername": "%s",
+				"encryptedPassword": "%s",
+				"timeCreated": 1700000000000
+			}
+		]
+	}`, encB64, encB64)
+
+	path := createTestJSON(t, "logins.json", json)
+
+	got, err := extractPasswords(testGlobalSalt, path)
+	require.NoError(t, err)
+	require.Len(t, got, 1)
+
+	// Both username and password decrypt to "Hello, World!"
+	assert.Equal(t, "Hello, World!", got[0].Username)
+	assert.Equal(t, "Hello, World!", got[0].Password)
+	assert.Equal(t, "https://example.com/login", got[0].URL)
+	assert.False(t, got[0].CreatedAt.IsZero())
+}
+
+func TestExtractPasswords_FormSubmitURLFallback(t *testing.T) {
+	encB64 := loginPBEBase64(t)
+
+	// When formSubmitURL is empty, should fall back to hostname
+	json := fmt.Sprintf(`{
+		"logins": [
+			{
+				"hostname": "https://fallback.com",
+				"formSubmitURL": "",
+				"encryptedUsername": "%s",
+				"encryptedPassword": "%s",
+				"timeCreated": 1700000000000
+			}
+		]
+	}`, encB64, encB64)
+
+	path := createTestJSON(t, "logins.json", json)
+
+	got, err := extractPasswords(testGlobalSalt, path)
+	require.NoError(t, err)
+	require.Len(t, got, 1)
+	assert.Equal(t, "https://fallback.com", got[0].URL)
+}
+
+func TestExtractPasswords_InvalidBase64Skipped(t *testing.T) {
+	// Invalid base64 in encryptedUsername — entry should be skipped
+	json := `{
+		"logins": [
+			{
+				"hostname": "https://bad.com",
+				"encryptedUsername": "not-valid-base64!!!",
+				"encryptedPassword": "also-bad",
+				"timeCreated": 1700000000000
+			}
+		]
+	}`
+
+	path := createTestJSON(t, "logins.json", json)
+
+	got, err := extractPasswords(testGlobalSalt, path)
+	require.NoError(t, err)
+	assert.Empty(t, got) // skipped, not error
+}
+
+func TestExtractPasswords_EmptyLogins(t *testing.T) {
+	path := createTestJSON(t, "logins.json", `{"logins": []}`)
+
+	got, err := extractPasswords(testGlobalSalt, path)
+	require.NoError(t, err)
+	assert.Empty(t, got)
+}