harden: verify the signed transaction against what the popup displayed (closes #216)

Verification compared the signed artifact against the dApp's request object.
For every field the dApp omitted -- normally nonce, gas limit and all the fee
fields, since the popup filled them in -- the number the user actually read on
screen was verified by nothing, and only absolute ceilings stood behind it.

The transaction is now populated in the background before the approval window
opens, and that populated object is both what the popup displays and what the
signed artifact is verified against. Every consequential field becomes an
equality comparison; the ceilings remain as a backstop. Population failing
means no approval and no window, and the error goes to the requesting page --
earlier than before, where the same estimate failed after the password had been
typed.

The account is pinned too: `from` is compared against the address named at
approval time rather than whichever address is active at signing, so switching
accounts mid-flow refuses instead of signing from an account the approval did
not name. The message-signing path had the same defect and gets the same fix.

Nonce selection moves earlier as a consequence; the concurrent-approval case
that follows from it is tracked at #271.

TODO.md

@@ -44,6 +44,17 @@ undefined identifiers, which is how
 
 # Completed Steps
 
+- 2026-08-12: The transaction a dApp asks for is now populated in the background
+  before the approval window opens, so the object the user is shown is the
+  object the signed artifact is verified against — nonce, gas limit and every
+  fee field are compared exactly instead of being left to the ceilings, which
+  stay as a backstop against what a lying RPC node can talk the wallet into
+  displaying. The approval also pins the address it was raised for, so an
+  address switch between approval and signing refuses rather than signing from
+  an account the screen never named, and a request naming an address that is not
+  the active one is refused outright. The approval screen now shows the fee, gas
+  limit, network and nonce it vouches for
+  ([#216](https://git.eeqj.de/sneak/AutistMask/issues/216)).
 - 2026-08-12: The restored navigation stack is filtered against
   `RESTORABLE_VIEWS` on load, truncated at the first entry the popup would not
   render so that every surviving entry keeps the Back target it had. Back after