tests: extract buildRecipients + partial implementation of crypto-popup.test.ts

[dobby-coder]

Follow-up to #110 (PR 5 of 5 per the plan on #105).

Summary

Pulls the `SerializedRecipient[] -> Recipient[]` mapping out of `yivi-popup.ts` into a new `src/pages/yivi-popup/recipients.ts`. The popup now calls `buildRecipients(pg.recipient, data.recipients)`. Production behavior is unchanged.

Implements 5 of 23 `it.todo` placeholders in `tests/crypto-popup.test.ts` (the recipient-rebuild subset: typed-vs-domain, custom policy mapping, no double-counting the email attribute, no `extraAttribute` when policy is absent).

The remaining 18 placeholders are scoped to the popup's `handleEncrypt` / `handleDecrypt` closures and the popup's DOM init. Reaching them needs either:

1. The popup loaded under jsdom with a stubbed pg-js, or
2. `handleEncrypt`/`handleDecrypt` extracted behind injected `pg` + `runtime` deps.

Both are substantial refactors and out of scope for this batch of test PRs. Tracking the remaining surface here so it isn't forgotten — the test count goes back up once that refactor lands.

Test report

Before: 59 passing, 82 todo.
After: 64 passing, 78 todo. (+5 tests; -4 todos)

Combined progress across the 5 follow-up PRs (#111–#115)

PR	Tests added	Todo reduction
#111 message-routing	+14	-11
#112 sent-copy	+9	-8
#113 encryption-flow	+19	-18
#114 decryption-flow	+19	-19
#115 crypto-popup	+5	-4
Total	+66	-60

Once all five land the suite moves from 21→87 passing and 108→48 todo — the remaining todos are the closures that need the larger refactor noted above.

Reviewer quickstart

```
git fetch origin && git checkout tests/crypto-popup && npm install && npm test
```

Refs #105.

[dobby-coder]

Self-review (the bot opened this PR, so GH blocks --approve). Posting findings here for the human reviewer:

• buildRecipients is a clean, behaviour-preserving extraction from yivi-popup.ts: same branch on r.type, same policy iteration, same EMAIL_ATTRIBUTE_TYPE skip.
• RecipientFactory = Pick<PostGuard["recipient"], "email" | "emailDomain"> keeps the production call site type-safe while letting tests inject a fake.
• Tests cover the meaningful invariants: typed-vs-domain dispatch, no double-counting the email attribute, no extraAttribute when policy is absent, and extraAttribute calls for non-email policy entries.
• npm test locally: 64 passed / 78 todo, matching the PR description. CI build is green.

The remaining 18 todos for handleEncrypt / handleDecrypt / DOM init are out of scope here and clearly documented as needing a deeper refactor.

No blockers from this agent's side — ready for human approval and merge.