Safari's masked extension frames stay out of Sentry

Safari reports an extension's scripts as webkit-masked-url://hidden/, so the
extension filter never matched them; WIZWAR-17 was one such failure.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

packages/web/src/main.ts

@@ -19,7 +19,8 @@ if (import.meta.env.VITE_SENTRY_DSN) {
     // Facebook's in-app browser injects its own scripts (iabjs://) and
     // reports their failures as ours when the page unloads.
     // Extensions run their own scripts in the page, and their failures are not ours.
-    denyUrls: [/^iabjs:\/\//, /^(chrome|moz|safari(-web)?)-extension:\/\//],
+    // Safari hides an extension's address behind webkit-masked-url.
+    denyUrls: [/^iabjs:\/\//, /^(chrome|moz|safari(-web)?)-extension:\/\//, /^webkit-masked-url:\/\//],
     ignoreErrors: ["Java object is gone"],
     beforeSend: (event) => JSON.parse(scrub(JSON.stringify(event))),
     beforeBreadcrumb: (crumb) => JSON.parse(scrub(JSON.stringify(crumb))),