Code quality improvement, fix critical security hole

[yellowsink]

Changes:

• use lune to build the plugin
• use the shelter injectCss API to add and remove styles
• split the CSS out into a separate file for readability (and minification)
• general cleanup
• switches to the shelter model of plugin development, in which polling the DOM in a loop is replaced by a flux subscription and a DOM observation.
• jesus christ for the love of god do not place fetch()ed data on the DOM using innerHTML - stopped that.