docs: correct three README claims contradicted by the code (closes #213)

- Blocklist attribution: the cited AugurProject/eth-phishing-detect repository
  no longer exists (GitHub returns 404), and the vendored list and the runtime
  refresh both come from the live upstream that BLOCKLIST_URL points at. The
  dead link is dropped, the project, copyright and license are kept, and a note
  records why no repository link is given.
- Token display: balances.js shows any ERC-20 with a nonzero balance that is in
  the bundled top-250 list, tracked, or has 1,000+ holders, so tokens do appear
  without the user adding them. The Data Model section now states that rule,
  including that it is unconditional while the 1,000-holder setting applies only
  to transaction history and the send selector. The manual-only claims elsewhere
  are corrected to match.
- Navigation: replaced the flat/no-tabs paragraph with the stack model the
  Screen Map documents, naming the AddWallet import tabs and the AddressDetail
  overflow menu.

TODO.md

@@ -44,6 +44,9 @@ undefined identifiers, which is how
 
 # Completed Steps
 
+- 2026-08-11: Three `README.md` claims corrected against the code — blocklist
+  attribution, token-display rule, navigation model
+  ([#213](https://git.eeqj.de/sneak/AutistMask/issues/213)).
 - 2026-08-11: README Screen Map rebuilt from the code — every screen, element
   and transition re-verified against `src/popup/`
   ([#164](https://git.eeqj.de/sneak/AutistMask/issues/164)).