fix: the bundled token list names tokens on Ethereum Mainnet only (closes #632)

bundledToken(address, chainId) in tokenList.js answers only for Ethereum
Mainnet's chain id. Every reader of TOKEN_BY_ADDRESS now goes through it,
with the chain id of the transaction, balance or history entry it draws.
The token sources the screens build carry that chain id. The Uniswap
decoder sets the transaction's chain id on them. fetchTokenBalances()
takes the chain id of the network it asks about.

isSpoofedSymbol() takes the chain id of the token's network. It checks the
bundled list's symbols only on Ethereum Mainnet. The native asset's labels
stay reserved on every network.

Twenty existing tests and four shared test helpers read the bundled
list without naming a network. Each now names Ethereum Mainnet.

Model: opus-5-5

tests/spoofedTrackedToken.test.js

@@ -18,6 +18,15 @@ const FAKE_USDT = {
     decimals: 6,
     name: "Tether USD",
 };
+// A Sepolia contract that reports USDT. The bundled list holds Ethereum Mainnet
+// contracts, so the spoof rule does not check this symbol on Sepolia
+// (https://git.eeqj.de/sneak/AutistMask/issues/632).
+const SEPOLIA_USDT = {
+    address: TOKEN_ADDRESS,
+    symbol: "USDT",
+    decimals: 6,
+    name: "Test USDT",
+};
 // A symbol the bundled list does not have, so the spoof rule passes it.
 const TEST_TOKEN = {
     address: "0xBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB",
@@ -31,9 +40,10 @@ afterEach(() => {
     cleanupPopup();
 });
 
-test("a fake token tracked at zero balance is not listed while zero balances are shown", async () => {
+test("on Ethereum Mainnet, a fake token tracked at zero balance is not listed while zero balances are shown", async () => {
     const boot = await bootPopup(
         unversionedValidProfile({
+            networkId: "mainnet",
             currentView: "address",
             selectedWallet: 0,
             selectedAddress: 0,
@@ -65,9 +75,10 @@ describe.each([
         "btn-settings-addtoken-manual",
     ],
 ])("%s", (_, opening, view, field, button) => {
-    test("refuses a fake token by contract address", async () => {
+    test("on Ethereum Mainnet, refuses a fake token by contract address", async () => {
         const boot = await bootPopup(
             unversionedValidProfile({
+                networkId: "mainnet",
                 currentView: "address",
                 selectedWallet: 0,
                 selectedAddress: 0,
@@ -88,4 +99,36 @@ describe.each([
         expect(boot.visibleViews()).toEqual([view]);
         expect(boot.storage.read("autistmask").trackedTokens).toEqual([]);
     });
+
+    test("on Sepolia, adds a contract that reports USDT and lists it", async () => {
+        const boot = await bootPopup(
+            unversionedValidProfile({
+                networkId: "sepolia",
+                currentView: "address",
+                selectedWallet: 0,
+                selectedAddress: 0,
+                showZeroBalanceTokens: true,
+            }),
+        );
+        for (const id of opening) await boot.click(id);
+        expect(boot.visibleViews()).toEqual([view]);
+        const { lookupTokenInfo } = require("../src/shared/balances");
+        lookupTokenInfo.mockResolvedValueOnce({
+            symbol: SEPOLIA_USDT.symbol,
+            decimals: SEPOLIA_USDT.decimals,
+            name: SEPOLIA_USDT.name,
+        });
+        boot.node(field).value = SEPOLIA_USDT.address;
+
+        await boot.click(button);
+        expect(boot.text("flash-msg")).not.toBe(REFUSED_FLASH);
+        expect(boot.storage.read("autistmask").trackedTokens).toEqual([
+            expect.objectContaining(SEPOLIA_USDT),
+        ]);
+        // SettingsAddToken stays up after adding, so this draws AddressDetail.
+        require("../src/popup/views/addressDetail").show();
+        expect(boot.node("address-balances").innerHTML).toContain(
+            `data-token="${SEPOLIA_USDT.address.toLowerCase()}"`,
+        );
+    });
 });