harden: key remembered site permissions by full origin (closes #402)

allowedSites and deniedSites held the bare hostname, so a grant to
https://dapp.example also authorised http://dapp.example and every port
on that host, and the connection, transaction and signature prompts
named only the hostname. Both lists now store and match the full origin
(scheme://host[:port]), the key the connections approved without
Remember already used. The prompts, the Settings site lists and
AUTISTMASK_REMOVE_SITE use the origin too. Entries saved by hostname
are not migrated (pre-1.0): they match no site.

Model: opus-5-5

README.md

@@ -1157,7 +1157,7 @@ each caught only by a reviewer re-deriving thirty fields by hand.
 The `allowedSites` case is why the entry check is not optional. A stored
 `{"0x…": "notalist"}` is a well-formed object holding a malformed entry: it
 passed the gate, rendered a completely healthy popup, and then threw inside
-`saveState()`'s per-hostname merge, so every save from that moment on failed and
+`saveState()`'s per-origin merge, so every save from that moment on failed and
 the user went on operating a wallet that was persisting nothing
 ([#362](https://git.eeqj.de/sneak/AutistMask/issues/362)). A save that fails is
 now also reported rather than swallowed: `onSaveFailure()` in
@@ -1631,13 +1631,13 @@ view would leave a wallet one click from deletion.
           a value carrying its unit, hex (`0x10`) or exponent (`1e3`) notation —
           is refused with a flash message and the field snaps back to the stored
           threshold, so a number the user did not type is never stored.
-    - Allowed Sites: the hostnames remembered as allowed, under any address,
-      with remove buttons
-    - Connected Sites: the hostnames of the sites allowed without "Remember my
+    - Allowed Sites: the origins (scheme, host and port) remembered as allowed,
+      under any address, with remove buttons
+    - Connected Sites: the origins of the sites allowed without "Remember my
       choice" that are still connected, with remove buttons. Only the background
       holds these, in memory, and Settings asks it for them with
       `AUTISTMASK_GET_CONNECTED_SITES`
-    - Denied Sites: the hostnames remembered as denied, under any address, with
+    - Denied Sites: the origins remembered as denied, under any address, with
       remove buttons
     - About: project link, license, author, version, release date, and the
       commit, which links to the commit in the repository
@@ -1651,10 +1651,11 @@ view would leave a wallet one click from deletion.
     - Tap wallet name → inline rename field (no screen change)
     - `[x]` on a tracked token → removes it in place (no screen change)
     - `[x]` on an allowed or connected site → disconnects that site, in place:
-      its hostname is dropped from Allowed Sites under every address, and
+      its origin is dropped from Allowed Sites under every address, and
       `AUTISTMASK_REMOVE_SITE` has the background end every connection approved
-      without "Remember" from an origin with that hostname, under any address,
-      and send `accountsChanged` with an empty list to the site's open tabs.
+      without "Remember" from that origin, under any address, and send
+      `accountsChanged` with an empty list to the open tabs of that origin. The
+      same host under another scheme or port is another site and is left alone.
       Only the extension's own pages may send either message
     - `[x]` on a denied site → forgets the refusal, in place; it connects
       nothing and tells the background nothing
@@ -1838,14 +1839,18 @@ view would leave a wallet one click from deletion.
 
 - **When**: A website requests wallet access via `eth_requestAccounts` or
   `wallet_requestPermissions` and is on neither the allowed nor the denied list.
-  The background script prefers the toolbar popup (`action.openPopup()`) and
-  falls back to a separate popup window (`src/background/index.js`,
+  A site is its full origin, `scheme://host[:port]`, on both lists and for a
+  connection allowed without "Remember": a choice for `https://dapp.example`
+  says nothing about `http://dapp.example` or another port of that host. The
+  background script prefers the toolbar popup (`action.openPopup()`) and falls
+  back to a separate popup window (`src/background/index.js`,
   `requestApproval()`).
 - **Elements**:
     - "Connection Request" heading
     - Phishing warning banner (shown when the hostname is on the phishing
       blocklist)
-    - Site hostname (bold) + "wants to connect to your wallet"
+    - Site origin (bold, scheme and port included) + "wants to connect to your
+      wallet"
     - Address that will be shared (color dot + full address + etherscan link)
     - "Remember my choice for this site" checkbox
     - "Allow" / "Deny" buttons
@@ -1875,7 +1880,8 @@ view would leave a wallet one click from deletion.
     - "Transaction Request" heading
     - Phishing warning banner (shown when the hostname is on the phishing
       blocklist)
-    - Site hostname (bold) + "wants to send a transaction"
+    - Site origin (bold, scheme and port included) + "wants to send a
+      transaction"
     - Decoded action (if calldata is recognized): action name, token details,
       amounts, steps, deadline (see Transaction Decoding)
     - From: color dot + full address + etherscan link
@@ -1906,7 +1912,8 @@ view would leave a wallet one click from deletion.
     - "Signature Request" heading
     - Phishing warning banner (shown when the hostname is on the phishing
       blocklist)
-    - Site hostname (bold) + "wants you to sign a message"
+    - Site origin (bold, scheme and port included) + "wants you to sign a
+      message"
     - Danger warning box (shown for `eth_sign`, which signs a raw hash)
     - Type: "Personal message" or "Typed data (EIP-712)"
     - From: color dot + full address + etherscan link