docs: describe the bundled token list by selection criterion, not count (closes #239)

The docs disagreed with the code and with each other about the size of the
bundled ERC-20 allowlist: four places in `README.md` said "top 250" and
`docs/README.md` said "roughly 500", while `TOKENS` in
`src/shared/tokenList.js` has 512 entries.

Rather than restate 512 in five places, which drifts again the next time the
list is regenerated, the count is dropped and the list is described by how it
is actually selected: a point-in-time snapshot of the highest-market-cap
Ethereum mainnet ERC-20s taken from the CoinGecko API, decimals verified
on-chain and addresses EIP-55 checksummed, bundled at build time. `TOKENS` in
`src/shared/tokenList.js` is named as the authoritative set. The four
incidental "top-250" mentions become "known-token list", the term the docs
already use elsewhere.

The "top N by market cap" ranking framing is accurate and is kept; only the
number is removed.

Documentation only: no code, config, script, CI or build file is touched.

TODO.md

@@ -44,6 +44,13 @@ undefined identifiers, which is how
 
 # Completed Steps
 
+- 2026-08-12: Bundled token list documentation no longer states a count. The
+  four "top 250" claims in `README.md` and the "roughly 500" claim in
+  `docs/README.md` are replaced with a description of how the list is actually
+  selected — a point-in-time CoinGecko snapshot of the highest-market-cap
+  Ethereum mainnet ERC-20s — with `TOKENS` in `src/shared/tokenList.js` named as
+  the authoritative set
+  ([#239](https://git.eeqj.de/sneak/AutistMask/issues/239)).
 - 2026-08-11: Known-symbol spoof verification became a Settings toggle
   (`hideSpoofedSymbols`), on by default, governing the transaction-history
   filter and the fraud-contract learning it feeds