Token auto-discovery, tx history, balance polling, EIP-6963, UI overhaul

Major changes:
- Fetch token balances and tx history from Blockscout API (configurable)
- Remove manual token discovery (discoverTokens) in favor of Blockscout
- HD address gap scanning on mnemonic import
- Duplicate mnemonic detection on wallet add
- EIP-6963 multi-wallet discovery + selectedAddress updates in inpage
- Two-tier balance refresh: 10s while popup open, 60s background
- Fix $0.00 flash before prices load (return null when no prices)
- No-layout-shift: min-height on total value element
- Aligned balance columns (42ch address width, consistent USD column)
- All errors use flash messages instead of off-screen error divs
- Settings gear in global title bar, add-wallet moved to settings pane
- Settings wells with light grey background, configurable Blockscout URL
- Consistent "< Back" buttons top-left on all views
- Address titles (Address 1.1, 1.2, etc.) on main and detail views
- Send view shows current balance of selected asset
- Clickable affordance policy added to README
- Shortened mnemonic backup warning
- Fix broken background script constant imports

README.md

@@ -97,6 +97,24 @@ crypto knowledge.
 - **360x600 popup**: Standard browser extension popup dimensions. The UI is
   designed for this fixed viewport — no responsive breakpoints needed.
 
+#### No Layout Shift
+
+Asynchronous state changes (clipboard confirmation, transaction status, error
+messages, flash notifications) must never move existing UI elements. All dynamic
+content areas reserve their space up front using `min-height` or always-present
+wrapper elements. `visibility: hidden` is preferred over `display: none` when
+the element's space must be preserved. This prevents jarring content jumps that
+disorient users and avoids mis-clicks caused by shifting buttons.
+
+#### Clickable Affordance
+
+Every interactive element must visually indicate that it is clickable. Buttons
+use a visible border, padding, and a hover state (invert to white-on-black).
+Text that triggers an action (e.g. "Import private key") uses an underline. No
+invisible hit targets, no bare text that happens to have a click handler. If it
+does something when you click it, it must look like it does something when you
+click it.
+
 #### Language & Labeling
 
 All user-facing text avoids crypto jargon wherever possible:
@@ -509,6 +527,13 @@ Everything needed for a minimal working wallet that can send and receive ETH.
 - [ ] Test on Chrome (Manifest V3)
 - [ ] Test on Firefox (Manifest V2)
 
+### Scam List
+
+- [ ] Research and document each address in scamlist.js (what it is, why it's on
+      the list, source)
+- [ ] Add more known fraud addresses from Etherscan labels (drainers, phishing,
+      address poisoning deployers)
+
 ### Post-MVP
 
 - [ ] EIP-1193 provider injection (window.ethereum) for web3 site connectivity