fix: carry EIP-1193 error codes through to the page (closes #274)

The provider rebuilt every rejection as a bare Error carrying only a message,
so a dApp checking err.code === 4001 saw undefined and could not tell a user's
deliberate refusal from a failure. Well-behaved sites therefore showed an error
or retried instead of accepting the refusal. The code was produced correctly
and did cross the extension boundary; it was lost in the last hop.

Rejections now reach the page as a ProviderRpcError carrying code, and data
where present. The code is passed through verbatim rather than matched against
a whitelist, so a code added upstream later needs no change here. An error that
genuinely has no code stays a plain Error with no code property at all, rather
than advertising code: undefined -- 'code' in err is what a careful dApp asks.

Messages are unchanged for every path, verified byte-for-byte against the
previous provider across every background error shape.

The end-to-end assertion that printed the observed code now requires it.

TODO.md

@@ -45,6 +45,20 @@ undefined identifiers, which is how
 
 # Completed Steps
 
+- 2026-08-12: EIP-1193 error codes now reach the page. `src/content/inpage.js`
+  rebuilt every failure as `new Error(error.message)`, so the code the
+  background produced and the content script relayed intact was dropped in the
+  last hop and a dApp checking `err.code === 4001` saw `undefined` — a wallet
+  the user deliberately declined was indistinguishable from one that broke. The
+  provider now rejects with a `ProviderRpcError` carrying `code` and, where the
+  boundary sent one, `data`, passed through verbatim rather than matched against
+  a list, so 4001, 4100 and 4902 all arrive and a future code needs no edit
+  here. An error the background sent with no code stays a plain `Error` with no
+  `code` property, and `message` is unchanged in every case. All four request
+  entry points (`request`, `enable`, `send`, `sendAsync`) are covered by
+  `tests/inpageErrors.test.js`, and the e2e probe that printed the missing code
+  now requires it on the page's Error as well as on the wire, for all four
+  rejected flows ([#274](https://git.eeqj.de/sneak/AutistMask/issues/274)).
 - 2026-08-12: `KNOWN_SYMBOLS` now maps a symbol to the set of contract addresses
   that bear it, not to one of them. A ticker is not unique: seven of the 512
   bundled tokens — `FRAX`, `REUSD`, `TON`, `EURE`, `MSUSD`, `MUSD` and `JPYC` —