fix: the Chrome layout tests and popup comments use the popup's real 396x600 size (closes #556)

POPUP_VIEWPORT in tests/e2e/run.js said 360x600, while body in
src/popup/styles/main.css is 396px wide and the background opens an
approval window at 396x600. It is now 396x600, defined once near the top
of the file, and the hostile token symbol's frame takes its size from it.

The transaction approval's sideways-scroll check now sets the approval
page to that size first. Headless Chromium opens the window at 1280x720,
where the page can never scroll sideways, so the check could not fail.
README's list of what the Chrome suite leaves out says so.

Two comments in src/popup/index.html that said 360x600 now say 396x600.

Model: opus-5-5

README.md

@@ -500,9 +500,11 @@ papered over:
   forced by clicking Reveal and the settings gear in one page task, which a
   person cannot do; the case a person can hit, the first decrypt after the popup
   opens while libsodium is still loading, is not driven.
-- Approval windows open at 1280x720 whatever size the extension asks for, so
-  whether an approval screen fits its window is checked in the Firefox suite
-  only.
+- Approval windows open at 1280x720 whatever size the extension asks for. The
+  transaction approval is checked for sideways scrolling at 396x600 by sizing
+  the page itself, which leaves out the window's frame and the page widening its
+  window, so whether an approval screen fits its window is checked in the
+  Firefox suite only.
 
 Any test that drives a failure path on purpose declares the `console.error` it
 is about to provoke, via `errors.expect()`. That is not a mute: the declaration