Add default/fallback container for unassigned sites

[tigredcarta]

Summary

• Adds a default container setting: when a site has no specific container assignment, it is automatically opened in a user-configured fallback container.
• New _maybeFallbackContainerCookieStoreId() method in assignManager reads the setting from storage, verifies the container still exists (auto-cleans if deleted), and returns the target cookieStoreId.
• onBeforeRequest() redirects to the fallback container when no site assignment matches and the fallback is configured — the tab is replaced cleanly using the existing createTabWrapper() path.
• New "Default container" section in the options page with a dropdown listing all available containers.

Test plan

• Go to Options → Default container, select a container (e.g. "Work")
• Open a new tab and navigate to a site with no assignment — it should reopen in "Work"
• Navigate to a site that has an assignment — it should still open in its assigned container (fallback must not interfere)
• Sites in a locked (isolated) container still redirect to firefox-default as before
• Delete the container selected as default — the setting is auto-cleaned, no redirect loop
• Set dropdown back to "No default" — unassigned sites load in whatever container they're in

Notes

The i18n strings (defaultContainer, defaultContainerLabel, defaultContainerDescription, defaultContainerNone) need to be added to the l10n submodule separately.

Closes #503 (partial — this implements the catch-all default; always-open-in-no-container is tracked separately in #2860)

🤖 Generated with Claude Code