fix: explain a rejected dust threshold instead of snapping back silently (closes #233)

The dust threshold field resynced to the stored value on a rejected input
and said nothing, so the box changed to a different number with no reason
given. It was the only validated input in the settings view that rejected
without a message.

Rejected input now shows one full sentence naming the constraint, using the
flash line already used by the RPC and Blockscout validation in the same
file. No layout shift: #flash-msg is always present with its height
reserved.

Hex and exponent notation are rejected rather than accepted. Number() reads
0x10 as 16 and 1e3 as 1000, which the earlier parseInt did not, and storing
either would put a number in the field that the user never typed - the same
silent substitution the message exists to end. Accepted input is plain
decimal digits only; the field is inputmode="numeric" and the unit is
printed beside it.

The parse moves to src/popup/dustThreshold.js, pure and unit tested, with
the message beside it so there is one wording. Tests cover the accepted set,
the rejected notations, that a rejection flashes the message and stores
nothing while a valid value stores and stays quiet, and that the flash line
reserves its height.

TODO.md

@@ -51,6 +51,11 @@ undefined identifiers, which is how
   Ethereum mainnet ERC-20s — with `TOKENS` in `src/shared/tokenList.js` named as
   the authoritative set
   ([#239](https://git.eeqj.de/sneak/AutistMask/issues/239)).
+- 2026-08-12: The dust threshold field now explains a rejection instead of
+  snapping back in silence, with the parse in a pure, unit-tested module that
+  accepts plain decimal digits only — hex and exponent notation are refused
+  rather than read as 16 and 1000
+  ([#233](https://git.eeqj.de/sneak/AutistMask/issues/233)).
 - 2026-08-11: Known-symbol spoof verification became a Settings toggle
   (`hideSpoofedSymbols`), on by default, governing the transaction-history
   filter and the fraud-contract learning it feeds