fix: Blockscout and Etherscan lookups are off until the user turns them on (closes #668)

Out of the box the wallet sent the user's addresses to Blockscout. It sent each
recipient to Etherscan for its label. Two settings, "Use Blockscout" and "Check
recipients on Etherscan", now gate those requests. Both are off in a new install
and offered unticked on Welcome and in Settings. While one is off, the screens
that relied on it say so in a plain line. Each gated request reads its setting
from storage before it asks and when the answer lands. An answer that lands
after the setting went off is dropped. An open popup takes a change another page
saved and draws its screens again. While "Use Blockscout" is off, no address
keeps an untracked token. ENS lookups ask only the RPC endpoint.

Model: opus-5-5

docs/README.md

@@ -57,11 +57,12 @@ analytics, use a portfolio tracker. The wallet is not the place for any of that.
 
 - **No NFT galleries or portfolio views.** This is a wallet, not a dashboard.
 
-- **No third-party token list APIs.** Token balances come from the same block
-  explorer you configure for transaction history, and the extension ships its
-  own hardcoded list of top ERC-20 contract addresses for symbol-spoofing
-  detection. Any token you want tracked across all your addresses, you add
-  yourself by contract address.
+- **No third-party token list APIs.** The balances of the tokens you track are
+  read from your RPC endpoint. While "Use Blockscout" is on, the other tokens
+  come from the same block explorer you configure for transaction history. The
+  extension ships its own hardcoded list of top ERC-20 contract addresses for
+  symbol-spoofing detection. Any token you want tracked across all your
+  addresses, you add yourself by contract address.
 
 - **No backend servers operated by the developer.** Nothing is sent to any
   server run by AutistMask. Every network destination is listed below.
@@ -69,8 +70,13 @@ analytics, use a portfolio tracker. The wallet is not the place for any of that.
 ## How It Works
 
 AutistMask is a browser extension that runs entirely in your browser. It does
-not have a backend server. It communicates with five external destinations:
-three you configure yourself, and two fixed ones used for scam detection.
+not have a backend server. Out of the box it sends your data only to the
+Ethereum RPC endpoint. It also asks the CoinDesk price API for prices, sending
+token symbols and nothing else.
+
+Blockscout and Etherscan are sent none of your data until you turn them on.
+Their settings are "Use Blockscout" and "Check recipients on Etherscan". Both
+are on the Welcome screen and in Settings. Both are off in a new install.
 
 ### External Services
 
@@ -84,10 +90,10 @@ this in Settings to any Ethereum JSON-RPC endpoint, including your own local
 node.
 
 When it is contacted: on every balance refresh (every 10 seconds while the popup
-is open, every 60 seconds in the background), when you type an ENS name into the
-Send screen, when a send is prepared and broadcast, while a pending transaction
-is polled for its receipt, and for the reverse ENS lookups used to label
-addresses (cached for 12 hours).
+is open, every 60 seconds in the background), when you review a send to an ENS
+name, when a send is prepared and broadcast, while a pending transaction is
+polled for its receipt, and for the reverse ENS lookups used to label addresses
+(cached for 12 hours).
 
 What gets sent: standard Ethereum JSON-RPC requests (balance queries,
 transaction broadcasts, gas estimates, ENS lookups, contract-code checks). Your
@@ -96,16 +102,31 @@ addresses are necessarily visible to the RPC provider when querying balances.
 **Blockscout API** (default: `eth.blockscout.com/api/v2`;
 `eth-sepolia.blockscout.com/api/v2` on Sepolia)
 
-Used to fetch token balances and transaction history. Blockscout is an
-open-source blockchain explorer. AutistMask queries it for your ERC-20 token
-balances (including the holder counts used for spam filtering) and your recent
-transactions and token transfers. You can change this in Settings to a
-self-hosted Blockscout instance.
+Blockscout is an open-source blockchain explorer. AutistMask sends it your data
+only while "Use Blockscout" is on. It then asks Blockscout for:
 
-When it is contacted: on every balance refresh, and whenever a screen showing
-transaction history is opened.
+- your recent transactions and token transfers
+- the balances of the tokens you have not tracked, with the holder counts used
+  for spam filtering
+- the block, fees and calldata of a transaction you open
 
-What gets sent: your Ethereum addresses (to look up balances and transactions).
+You can change this in Settings to a self-hosted Blockscout instance. While the
+setting is off, each screen that would show Blockscout's data says so instead.
+Only the tokens you track are listed. When you turn the setting off, every other
+token leaves the lists at once.
+
+When it is contacted, while "Use Blockscout" is on:
+
+- on every balance refresh
+- whenever a screen showing transaction history is opened
+- when you open a transaction
+
+Whether or not the setting is on, pressing "Save" beside the Blockscout URL in
+Settings asks that URL for `/stats` to check it. That request sends none of your
+data.
+
+What gets sent: your Ethereum addresses (to look up balances and transactions)
+and the hash of each transaction you open.
 
 **CoinDesk CADLI price API** (`data-api.coindesk.com`)
 
@@ -122,16 +143,21 @@ address.
 
 **Etherscan address labels** (`etherscan.io`; `sepolia.etherscan.io` on Sepolia)
 
-When you review a send, AutistMask fetches the recipient's public Etherscan
-address page and looks for a "Fake_Phishing"/"Phish/Hack" label or a scam
-warning, and shows a red warning if it finds one. This is a plain page fetch
-with no API key, made by your browser. It is best-effort: if it fails, it is
-silently ignored. This endpoint is not user-configurable.
+While "Check recipients on Etherscan" is on, AutistMask fetches the recipient's
+public Etherscan address page when you review a send. It looks for a
+"Fake_Phishing"/"Phish/Hack" label or a scam warning, and shows a red warning if
+it finds one. This is a plain page fetch with no API key, made by your browser.
+It is best-effort: if it fails, it is silently ignored. This endpoint is not
+user-configurable.
 
-When it is contacted: each time you reach the send confirmation screen.
+The setting is off in a new install. While it is off, the confirmation screen
+says that no Etherscan check was made.
 
-What gets sent: the recipient address you are about to send to, and your IP
-address. Your own addresses are not sent.
+When it is contacted: only while "Check recipients on Etherscan" is on, each
+time you reach the send confirmation screen.
+
+What gets sent: the recipient's address and nothing else. As with any request,
+Etherscan sees your IP address.
 
 Etherscan links shown elsewhere in the UI (on addresses, transactions, and token
 contracts) are ordinary links. They contact nothing until you click them.
@@ -185,6 +211,9 @@ password.
 
 1. Click the AutistMask icon in your browser toolbar.
 2. Click "Add wallet" (on first use), or open Settings and click "+ Add wallet".
+   On first use, the screen with "Add wallet" also offers "Use Blockscout" and
+   "Check recipients on Etherscan", both off. Tick either if you want what it
+   does (see External Services). You can change both later in Settings.
 3. On the "From Phrase" tab, click the die button to generate a random 12-word
    recovery phrase.
 4. **Write down the recovery phrase and store it safely.** Anyone with these
@@ -220,10 +249,14 @@ always produce the same sequence of addresses.
 
 ### Adding ERC-20 Tokens
 
-Tokens you hold show up automatically only if they are in the extension's
-bundled list of well-known tokens or have at least 1,000 holders; everything
-else is treated as spam and hidden. To track a token explicitly (which also
-shows it at zero balance), add it by contract address:
+Tokens you hold show up automatically only while "Use Blockscout" is on. Even
+then, a token shows up only if it is in the extension's bundled list of
+well-known tokens or has at least 1,000 holders. Everything else is treated as
+spam and hidden.
+
+A token you track is shown whether or not "Use Blockscout" is on. By default it
+is shown at zero balance too (see Display in Settings). To track a token, add it
+by contract address:
 
 1. Go to an address detail view (click `[info]` on any address).
 2. Click "+ Token".
@@ -239,7 +272,8 @@ screen. Tokens can also be added from Settings, under "Tracked Tokens".
 1. Click "Send" from the home screen or an address detail view.
 2. Select what to send (ETH, or any ERC-20 token with a balance on this address
    that survives the spam filters).
-3. Enter the recipient address or ENS name (e.g. `vitalik.eth`).
+3. Enter the recipient address or ENS name (e.g. `vitalik.eth`). AutistMask does
+   not look up a name resolved off-chain, so enter its address instead.
 4. Enter the amount, or click "Max" to fill it in: a token's balance, cut to 18
    decimal places, or your ETH balance minus the amount reserved for the network
    fee.
@@ -389,8 +423,9 @@ Click the gear icon on the home screen to access settings:
   that network's defaults if you have not used it before.
 - **Ethereum RPC**: Change the Ethereum node endpoint. Default is a public RPC.
   You can use your own node for maximum privacy.
-- **Blockscout API**: Change the Blockscout instance used for token balances and
-  transaction history. You can use a self-hosted instance.
+- **Blockscout API**: the "Use Blockscout" checkbox, off until you tick it, and
+  the URL of the Blockscout instance. You can use a self-hosted instance.
+- **Etherscan**: "Check recipients on Etherscan", off until you tick it.
 - **Token Spam Protection**: Toggle individual scam filters and set the dust
   transaction threshold.
 - **Allowed Sites / Denied Sites**: View and manage web3 site permissions.