fix: version stored state, validate its shape, and give a corrupt blob a way out (closes #311)

Stored state had no version and no structural validation, so a corrupt blob produced a completely blank popup with no message and no recovery control, and made every dApp RPC call from every page answer a generic -32603. There was no reset or wipe control anywhere in the UI.

saveState() now stamps a schema version and loadState() validates the shape. A version it does not understand, or a wallets array it cannot parse, lands on a recovery screen that names the problem, offers the stored record verbatim for export, and offers a destructive reset behind a typed confirmation. Unversioned but valid state -- which every existing install has -- migrates in place and keeps working; it is never shown a wipe prompt. A dApp call against unusable state answers -32007, which EIP-1474 leaves unassigned, rather than -32603. networkById() refuses an unknown id loudly instead of returning mainnet, and networkId is validated so a corrupt value cannot be used as an object key.

Fields the gate does not refuse are floored by type, container and entries both: a malformed trackedTokens or tokenBalances entry is dropped rather than dereferenced. Verified by an independent sweep of 1152 corrupt blobs producing no blank popup, with the same harness showing 9 blanks against the previous revision.

tests/backgroundApproval.test.js

@@ -175,8 +175,22 @@ function loadBackground(options) {
     }
 
     const persisted = {
+        // Address RECORDS, not bare address strings: a stored profile is
+        // validated against the schema on every read now
+        // (src/shared/stateSchema.js), and a bare string where a record
+        // belongs is one of the shapes that refuses to load.
         wallets: [
-            { name: "Wallet 1", type: "hd", addresses: [signer.address] },
+            {
+                name: "Wallet 1",
+                type: "hd",
+                addresses: [
+                    {
+                        address: signer.address,
+                        balance: "0",
+                        tokenBalances: [],
+                    },
+                ],
+            },
         ],
         networkId: "mainnet",
         rpcUrl: "https://rpc.invalid",