fix: add a Settings toggle for known-symbol spoof verification (closes #176)

The README promises all four token-spam filters "default to on but can be
individually disabled". Known-symbol spoof verification had no state flag, no
checkbox and no consulted setting: filterTransactions() applied it before any
filter setting was read, so three of the four documented filters were
configurable and the fourth was mandatory.

Adds hideSpoofedSymbols, default on, persisted and migrated so a profile
written before the setting existed loads it as on rather than undefined. The
flag is fail-safe in the pure function too: only an explicit false disables
the check, so a caller that omits the key keeps it.

Turning the setting off also stops the fraud-contract learning. That learning
is fed only by this check, and leaving it on would make the setting a no-op:
the contract it recorded would hide the very row the user asked to see, via
the fraud-contract rule that is on by default.

Scope: the setting governs the transaction history. The same check on the
balance list and the send-screen token selector stays unconditional — those
decide which tokens the user can act on, not what the history displays. The
README's user-configurable paragraph now states what each of the four
settings actually reaches, which is not uniform.

The two `current behaviour:` tests pinning the filter as undisableable are
inverted rather than deleted, and joined by coverage for the bypass, the
halted learning, the untouched sibling rules and the storage round-trip.

docs/README.md

@@ -323,7 +323,14 @@ by default:
 **Known token symbol verification.** AutistMask ships a list of roughly 500
 legitimate ERC-20 tokens with their contract addresses. If a transaction or
 balance claims to involve a known symbol (like "ETH" or "USDT") but comes from
-an unrecognized contract, it is identified as a spoof and hidden.
+an unrecognized contract, it is identified as a spoof and hidden. In your
+transaction history this is the "Hide fake tokens impersonating a known symbol"
+setting, which you can switch off; doing so also stops new entries being added
+to the fraud contract blocklist below, since detecting a spoof is what fills it.
+The send token list always applies the check. Your balances apply it too, with
+one exception: a token claiming the symbol "ETH" is not filtered there, so a
+fake "ETH" token can still show up in your balance list even though it is hidden
+from your transaction history and from the send token list.
 
 **Low-holder token filtering.** Tokens with fewer than 1,000 holders are hidden
 from transaction history and the send token list, and are left out of your