test: drive the StateRecovery screen in both browser suites (closes #361)

A stored record a newer build wrote opens the popup on the recovery
screen. Export Saved Data puts that record, exactly as stored, in the
text box; a near-miss confirmation phrase erases nothing; the exact
phrase erases it and reloads into Welcome. Chrome and Firefox run the
same four cases, each under its shipped CSP.

They run before any wallet exists: with no wallet nothing saves on a
timer, so no save can write a good record over the unreadable one, and
the erase leaves the popup on Welcome for wallet creation. If any of
them fails, the last one removes the record so later tests still start
from Welcome.

Model: opus-5-5

TODO.md

@@ -45,6 +45,16 @@ but the review is broader than any of them.
 
 # Completed Steps
 
+- 2026-10-05: The StateRecovery screen is driven in a real browser under the
+  shipped CSP, in both end-to-end suites
+  ([#361](https://git.eeqj.de/sneak/AutistMask/issues/361)). A stored record
+  this build cannot read opens the popup on it; its export text box holds the
+  record exactly as stored; a near-miss confirmation phrase erases nothing; and
+  the exact phrase erases the record and reloads into Welcome. The cases run
+  before any wallet exists: with no wallet nothing saves on a timer, so no save
+  can write a good record over the unreadable one, and the erase leaves the
+  popup on Welcome for wallet creation.
+
 - 2026-10-05: Escaping in the popup's views follows its own rule with no
   exceptions ([#329](https://git.eeqj.de/sneak/AutistMask/issues/329)). The
   decimals and holder count on a token's screen, and every USD figure (the ETH