Track browser-extension requests separately in the dashboard (#107)

Track browser-extension requests separately in the dashboard (#107)

Add a `source` column to request logs so `/api/mask` calls sent with the
`X-PasteGuard-Source: browser-extension` header are counted and badged
separately from direct API calls and provider-proxied requests.

- Backfill `source` from `provider` for existing rows via migration
- Split stats into api_requests vs browser_extension_requests
- Replace the route-only Provider column with a unified Source column
- Add an Extension stat card