fix(1.0.12): skip passive Google sign-in popups

YouTube auto-opens window.open on accounts.google.com/...?passive=true&...
at page load to silently pick up an existing Google session via postMessage.
Our setWindowOpenHandler was routing these to the OAuth popup, where Google
detects no parent context and shows "JavaScript отключен".

Tighten isGoogleLoginUrl to exclude passive=true URLs — let them get denied
without a popup. Active "Войти" clicks have no passive flag and continue
to open the popup as before.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

package.json

@@ -1,6 +1,6 @@
 {
   "name": "ESH-Media",
-  "version": "1.0.11",
+  "version": "1.0.12",
   "private": true,
   "main": "main.js",
   "scripts": {