fix: only the user switches the wallet's network (closes #408)

A connected site's wallet_switchEthereumChain request for the other
supported network now opens a prompt in its own window, through the
existing approval machinery, naming the site and both networks. The
network, endpoints, balances and caches change, and chainChanged is
sent, only when the user approves it; rejecting or closing the prompt
answers 4001. One such prompt per site at a time; a request for the
active network needs none. The approval window no longer shows the
connection prompt while it waits for the approval's description,
since both prompts answer on the same port.

Model: opus-5-5

tests/nativeCurrency.test.js

@@ -345,10 +345,10 @@ describe.each([
 });
 
 // A transaction's value and fee are in the native currency of the network the
-// transaction is on, which need not be the active one. A site can switch the
-// active network after its transaction is prepared and back before it is
-// signed, and a popup opened after a switch shows a sent or listed transaction
-// again. The wallet's balances follow the active network; these do not.
+// transaction is on, which need not be the active one. The active network can
+// change, in Settings or when the user approves a site's request, after a
+// transaction is prepared and change back before it is signed, and a popup
+// opened after a switch shows a sent or listed transaction again. The wallet's balances follow the active network; these do not.
 describe.each([
     ["mainnet", "sepolia", "ETH"],
     ["sepolia", "mainnet", "SepoliaETH"],