fix: the bundled token list names tokens on Ethereum Mainnet only (closes #632)

bundledToken(address, chainId) in tokenList.js answers only for Ethereum
Mainnet's chain id. Every reader of TOKEN_BY_ADDRESS now goes through it,
with the chain id of the transaction, balance or history entry it draws.
The token sources the screens build carry that chain id. The Uniswap
decoder sets the transaction's chain id on them. fetchTokenBalances()
takes the chain id of the network it asks about.

isSpoofedSymbol() takes the chain id of the token's network. It checks the
bundled list's symbols only on Ethereum Mainnet. The native asset's labels
stay reserved on every network.

Twenty existing tests and four shared test helpers read the bundled
list without naming a network. Each now names Ethereum Mainnet.

Model: opus-5-5

src/shared/tokenList.js

@@ -3953,6 +3953,15 @@ for (const t of TOKENS) {
     TOKEN_BY_ADDRESS.set(t.address.toLowerCase(), t);
 }
 
+// The bundled list's entry for the contract at `address` on the network with
+// chain id `chainId`, or null. The list holds Ethereum Mainnet contracts only.
+// A contract at the same address on another network is another token, so any
+// other chain id gets null.
+function bundledToken(address, chainId) {
+    if (chainId !== NETWORKS.mainnet.chainId) return null;
+    return TOKEN_BY_ADDRESS.get((address || "").toLowerCase()) || null;
+}
+
 // Build a map of symbol (uppercased) -> the set of contract addresses
 // (lowercased) that legitimately bear it.  Used for spoofed-symbol detection.
 // "ETH" maps to null: the native asset has no contract, so no contract may
@@ -3969,7 +3978,8 @@ for (const t of TOKENS) {
 // hides from the balance list, the history and the send selector at its own
 // address, so the user cannot spend it (issue #276).  Naming every address
 // that bears the symbol is the only shape that says what is true; it does not
-// loosen the rule, because a contract outside the set is still a spoof.
+// loosen the rule.  On Ethereum Mainnet, a contract outside the set is still a
+// spoof.
 const KNOWN_SYMBOLS = new Map();
 KNOWN_SYMBOLS.set("ETH", null);
 for (const network of Object.values(NETWORKS)) {
@@ -3988,14 +3998,15 @@ for (const t of TOKENS) {
     }
 }
 
-// Resolve a token symbol from multiple sources, never returning "?".
-function resolveSymbol(tokenAddress, tokenBalances, trackedTokens) {
+// Resolve a token symbol from multiple sources, never returning "?". The token
+// is a contract on the network with chain id `chainId`.
+function resolveSymbol(tokenAddress, tokenBalances, trackedTokens, chainId) {
     const lower = (tokenAddress || "").toLowerCase();
     const tb = (tokenBalances || []).find(
         (t) => t.address.toLowerCase() === lower,
     );
     if (tb && tb.symbol) return tb.symbol;
-    const known = TOKEN_BY_ADDRESS.get(lower);
+    const known = bundledToken(lower, chainId);
     if (known && known.symbol) return known.symbol;
     const tracked = (trackedTokens || []).find(
         (t) => t.address.toLowerCase() === lower,
@@ -4012,5 +4023,6 @@ module.exports = {
     USD_PRICE_FEEDS,
     PRICE_FEED_BY_ADDRESS,
     getTopTokens,
+    bundledToken,
     resolveSymbol,
 };