fix: move the UTC Timestamps checkbox into the Display well (closes #212)

The `settings-utc-timestamps` checkbox sat inside the Token Spam Protection
well, immediately after the dust-threshold input. It is a display preference
and has nothing to do with spam filtering, so it now renders in the Display
well next to the theme selector.

Markup move only. The checkbox is wired by id — `$("settings-utc-timestamps")`
in `src/popup/views/settings.js`, where `$` is `document.getElementById` — for
both the initial `checked` assignment and the `change` handler, so nothing in
the wiring depends on the element's parent or siblings. `state.utcTimestamps`,
`saveState`/`loadState` and the `helpers.js` formatting path are untouched.

Both Settings descriptions follow the markup: the `README.md` Screen Map and
the `docs/README.md` Settings list each now name the UTC control under Display
and no longer under Token Spam Protection.

`tests/settingsUtcTimestamps.test.js` pins both halves down: the checkbox
appears exactly once and inside the Display well rather than the spam well,
and the setting still round-trips through storage.

TODO.md

@@ -48,6 +48,9 @@ undefined identifiers, which is how
   `dist/` is a real directory, so a path with a trailing space or a newline can
   no longer carry a debug marker past the unlisted-bundle check
   ([#223](https://git.eeqj.de/sneak/AutistMask/issues/223)).
+- 2026-08-11: UTC Timestamps checkbox moved from the Token Spam Protection well
+  into Display, next to the theme selector
+  ([#212](https://git.eeqj.de/sneak/AutistMask/issues/212)).
 - 2026-08-11: A dust threshold of `0` now means "hide nothing" instead of
   falling back to the 100,000 gwei default, and every address comparison in
   `src/shared/transactions.js` goes through one case-normalising helper so a