test: drive the Settings screen in a browser and guard every popup element id (closes #229)

TODO.md

@@ -44,6 +44,34 @@ but the review is broader than any of them.
 
 # Completed Steps
 
+- 2026-08-17: The Settings screen is driven in a browser, and every element id
+  the popup looks up is checked statically. Nothing exercised Settings in the
+  e2e suite, and jest runs with no DOM, so the densest run of `$("...")` lookups
+  in the codebase was unverified at runtime. Seven new cases in
+  `tests/e2e/run.js` reach Settings, assert the About well and the wallet list
+  were actually written, assert the four Token Spam Protection checkboxes are
+  real checkboxes defaulted on, and assert the theme and network selectors offer
+  the choices `src/shared/networks.js` and `index.html` define. The selectors
+  are then driven to `dark` and `sepolia` — neither is the first `<option>`, so
+  neither can be read back from the markup with no JavaScript involved — and
+  reasserted after a popup reopen before being restored the same way, and one
+  spam filter is toggled off and back on across a reopen each way. Those round
+  trips run the change handler, `saveState()`, `loadState()` and the
+  `init()`/`show()` assignments rather than just looking at the screen. `show()`
+  no longer guards its `settings-network` lookup with `if (networkSelect)`: a
+  missing element must fail loudly, which is the whole failure mode this unit
+  exists to catch. Each group records a coverage key and a final case demands
+  the exact set, so a shortened or skipped section reddens the run instead of
+  shrinking it. `tests/popupElementIds.test.js` is the general half and runs in
+  `make check` with no browser: every literal id reached through `$()`,
+  `document.getElementById()`, `showError()`/`hideError()` and `showView()` must
+  exist in `src/popup/index.html`, which no id in `index.html` may define twice.
+  Demonstrated on four deliberate breaks — a typo'd id (both halves red), a
+  handler bound to the wrong but existing element (only the functional e2e case
+  red), a typo in a view no browser suite opens (only the static guard red), and
+  the deletion of both persisted-value assignments in `settings.js` (only the
+  selector round-trip case red)
+  ([#229](https://git.eeqj.de/sneak/AutistMask/issues/229)).
 - 2026-08-17: One wording for an empty password field on every screen that asks
   for one. The private key export screen said "Password is required." where the
   other five say "Please enter your password.", the same one-condition-two-