docs: correct docs/README.md external services and remove competitor names (closes #163)

Rewrote the user guide against the code:

- No competitor is named anywhere; the opening, the derivation-path note
  and the FAQ make their points without them.
- Removed the false "no remote phishing blocklist" claim. The blocklist
  fetch is documented as what it is: a bundled copy plus a live fetch on
  background startup and every 24h.
- External Services now lists all five destinations (RPC, Blockscout,
  CoinDesk, phishing blocklist, Etherscan label lookup) with what is sent
  and when.
- Password statements cover transaction signing, message and typed-data
  signing, private key export and wallet deletion.
- Add Wallet is documented as the three tabs that exist (phrase, private
  key, xprv), not a nonexistent link.
- Settings matches the shipped screen: tracked tokens, network selector,
  theme, UTC timestamps, About.
- Corrected token-list size, token discovery behaviour, Sepolia support,
  and the send/approval button labels.

TODO.md

@@ -44,6 +44,9 @@ undefined identifiers, which is how
 
 # Completed Steps
 
+- 2026-08-11: `docs/README.md` rewritten against the code: no competitor names,
+  all five network destinations documented, password/Settings/Add Wallet
+  sections corrected ([#163](https://git.eeqj.de/sneak/AutistMask/issues/163)).
 - 2026-08-11: Wallet deletion repairs its own state — `hasWallet` follows the
   remaining wallets, the selection only moves when it was deleted, and the
   active-address change is broadcast to connected sites