fix: store an absent explorer decimals as unknown instead of fabricating 18 (closes #349)

parseInt(decimals || "18") ran before writing stored tokenBalances[].decimals, so an explorer reporting no decimals produced a fabricated 18 indistinguishable from a real one at read time. That defeated the resolve-or-refuse guarantees of #306 and #340: their refusal paths were intact but never fired, because the guess was laundered upstream of them.

An absent scale is now stored as unknown, and a holding whose scale nothing knows carries a null balance -- unknown, never zero -- with six reader sites saying so rather than printing 0.0000. The Send screen resolves the display scale rather than reading the stored one, so a bundled token whose explorer row omits decimals still sends; when the scale cannot be resolved the stored quantity is withdrawn too, so the user is told the balance is unknown rather than only that the fee failed.

Existing fabricated 18s cannot be told apart retroactively and are replaced wholesale on the next balance refresh. An explorer-sourced scale stays trusted -- only fabrication is removed; the reasoning is recorded on the issue.

src/popup/views/confirmTx.js

@@ -139,12 +139,17 @@ function show(txInfo) {
 
     // Balance (with inline USD)
     if (isErc20) {
-        const bal = txInfo.tokenBalance || "0";
-        const balUsd = tokenPrice ? parseFloat(bal) * tokenPrice : null;
-        $("confirm-balance").textContent = valueWithUsd(
-            bal + " " + symbol,
-            balUsd,
-        );
+        // null is a balance whose scale nothing knows, not a balance of zero
+        // (https://git.eeqj.de/sneak/AutistMask/issues/349). The send is
+        // refused at encode time for the same missing scale; what this line
+        // must not do is state a quantity nobody established.
+        const bal = txInfo.tokenBalance;
+        const balUsd =
+            tokenPrice && bal != null ? parseFloat(bal) * tokenPrice : null;
+        $("confirm-balance").textContent =
+            bal == null
+                ? "unknown (" + symbol + ")"
+                : valueWithUsd(bal + " " + symbol, balUsd);
     } else {
         const bal = txInfo.balance || "0";
         const balUsd = ethPrice ? parseFloat(bal) * ethPrice : null;
@@ -235,17 +240,22 @@ function renderValidation(txInfo) {
     }
     if (codes.includes(CODES.INSUFFICIENT_TOKEN)) {
         messages.push(
-            "Insufficient " +
-                symbol +
-                " balance. You have " +
-                txInfo.tokenBalance +
-                " " +
-                symbol +
-                " but are trying to send " +
-                txInfo.amount +
-                " " +
-                symbol +
-                ".",
+            txInfo.tokenBalance == null
+                ? "This token's balance is unknown, because nothing this" +
+                      " wallet can consult reports how many decimal places it" +
+                      " uses, so the amount you are trying to send cannot be" +
+                      " checked against it."
+                : "Insufficient " +
+                      symbol +
+                      " balance. You have " +
+                      txInfo.tokenBalance +
+                      " " +
+                      symbol +
+                      " but are trying to send " +
+                      txInfo.amount +
+                      " " +
+                      symbol +
+                      ".",
         );
     }
     if (codes.includes(CODES.INSUFFICIENT_ETH)) {