fix: render a hostile token symbol as text, and put a floor under the CSP (closes #307)

A token's symbol is whatever its symbol() returns, the block explorer passes it
through unfiltered, and balanceLine() interpolated it into an innerHTML string.
A token with the 1,000 holders the spam filter asks for, airdropped to the
victim, could therefore paint a full-viewport cross-origin iframe over the
wallet's own UI, on the screens where the user is used to typing their password.

escapeHtml moves to the new src/shared/html.js as a pure string replace over &,
<, >, " and '. The implementation it replaces round-tripped through a detached
element's textContent, which escapes neither quote character, and it was already
in use inside data-copy="..." and would have been inside href="...". Being pure
also makes it testable without a DOM shim.

Every interpolation into an innerHTML string across src/popup/views/ was audited
rather than only the reported one. Also unescaped: the transaction lists'
direction label (the explorer's method name, attacker-chosen for an attacker's
contract), the wallet name and ENS name in the Home wallet list, the URL in the
explorer link's href, the blockie data: URI, and the confirmation screen's
warning line, which carries only fixed strings today but is one wiring change
from carrying scraped explorer text. Explorer URLs are now built by one helper
that percent-encodes the path segment, so a from/to out of explorer JSON cannot
re-point the link. Where a value is a markup fragment this code just built, or a
loop index, or a locally computed number, it stays bare; the rule and the reason
are stated at the top of helpers.js.

Both manifests now declare default-src 'self' with frame-src 'none'. Four
directives had to stay looser than 'self' and none of them generalises:
style-src needs 'unsafe-inline' because the popup sets presentation through
style="..." attributes and Firefox has never implemented style-src-attr; img-src
needs data: for the blockies; connect-src needs https: and http: because the RPC
endpoint is user-configurable and a local node over http://127.0.0.1 is a
supported configuration. frame-src, form-action and base-uri are named rather
than inherited, because the last two do not fall back to default-src at all.
tests/manifest.test.js now pins the whole directive set exactly, in both
directions, and README.md carries the reasoning.

Displayed symbols are capped at 12 characters, the bound lookupTokenInfo()
already applied to a symbol read straight off a contract; the explorer path had
none. The cap is a layout bound and is documented as not being the security
control. isSpoofedSymbol() is untouched: it answers whether a symbol collides
with a known ticker, which is a different question, and repurposing it here
would have been the wrong control.

Verified failing first, four ways. Restricting escapeHtml to & < > (the escape
the old textContent round trip actually performed) fails 5 unit tests including
the data-copy attribute break-out. Removing the length cap fails 3. Dropping
default-src from manifest/chrome.json fails 2. Removing both the escape and the
cap and running the full Chrome suite fails the new browser test with the
attack reproduced: an <iframe id="pwn"> in the popup DOM, intercepting pointer
events over the Back button.

TODO.md

@@ -44,6 +44,28 @@ but the review is broader than any of them.
 
 # Completed Steps
 
+- 2026-08-20: A hostile ERC-20 symbol no longer renders as live HTML in the
+  popup ([#307](https://git.eeqj.de/sneak/AutistMask/issues/307)). A token
+  symbol is whatever the contract's `symbol()` returns, the block explorer
+  passes it through unfiltered, and `balanceLine()` interpolated it into an
+  `innerHTML` string — so a token with the 1,000 holders the spam filter asks
+  for, airdropped to the victim, could paint a full-viewport cross-origin iframe
+  over the wallet's own UI, on the screens where the user types their password.
+  `escapeHtml` moved to `src/shared/html.js` as a pure string replace over `&`,
+  `<`, `>`, `"` and `'`: the old implementation round-tripped through a detached
+  element's `textContent`, which does not escape quotes, and it was already
+  being used inside `data-copy="..."`. Every interpolation into an `innerHTML`
+  string across `src/popup/views/` was audited, not just the reported one — the
+  transaction lists' direction label, the wallet name and ENS name in the Home
+  list, the `href` in the explorer link, and the confirmation screen's warning
+  line were all unescaped as well. Both manifests now declare
+  `default-src 'self'` with `frame-src 'none'`; the four directives that had to
+  stay looser than `'self'` are named and justified in the Content Security
+  Policy section of README.md, and `tests/manifest.test.js` pins the whole set
+  exactly. A display cap of 12 characters bounds the symbol, matching the bound
+  `lookupTokenInfo()` already applied on the contract-read path. Not repurposed
+  for any of this: `isSpoofedSymbol()`, which answers a different question and
+  would have been the wrong control.
 - 2026-08-20: A page asking which chain the wallet is on is told the chain the
   user is actually on ([#317](https://git.eeqj.de/sneak/AutistMask/issues/317)).
   `eth_chainId` and `net_version` answered from `currentNetwork()`, which reads