fix: judge the symbol a user sees, not the bytes a contract returns (closes #260)

A token whose symbol is " ETH " missed KNOWN_SYMBOLS on all three surfaces
while HTML collapsed the padding and painted it as ETH next to the user's
real ETH. isSpoofedSymbol() now normalizes before the lookup: NFKC, every
Unicode format character removed wherever it sits, then trimmed, then
uppercased. All three surfaces inherit it unchanged.

Covered: ASCII and Unicode whitespace padding, zero-width and other
invisible format characters, and compatibility variants such as fullwidth
letters. Knowingly left open, and asserted as open in the suite: confusables
that are distinct letters (Cyrillic capital Ie), bidi reordering, and
interior whitespace, which renders differently and so is not the confusion.

No symbol in KNOWN_SYMBOLS or the bundled token list contains whitespace or
a non-ASCII character, so nothing legitimate is newly filtered; a test walks
the whole table and asserts it.

The balance list's token-type gate is now case-insensitive. It compared
exactly, so an explorer writing "erc-20" would silently drop a real holding
before any filter ran. Which types are admitted is unchanged.

TODO.md

@@ -44,6 +44,18 @@ undefined identifiers, which is how
 
 # Completed Steps
 
+- 2026-08-12: The known-symbol spoof rule now judges the symbol a user actually
+  sees. `isSpoofedSymbol()` normalizes before the lookup — NFKC, then every
+  format and default-ignorable character removed, then trimmed — so `" ETH "`, a
+  no-break space, a zero-width space, a Hangul filler, a variation selector and
+  a fullwidth `ＥＴＨ` are all caught on the balance list, the history and the
+  send selector at once. Confusables that are distinct letters (Cyrillic `Е`),
+  bidi reordering, the visible C0/C1 controls and U+007F stay knowingly open and
+  are asserted as open in the suite. No bundled symbol contains whitespace or a
+  non-ASCII character, so nothing legitimate is newly filtered; the balance
+  list's token-type gate also became case-insensitive, which no longer drops a
+  real holding if an explorer writes `erc-20`
+  ([#260](https://git.eeqj.de/sneak/AutistMask/issues/260)).
 - 2026-08-12: The restored navigation stack is filtered against
   `RESTORABLE_VIEWS` on load, truncated at the first entry the popup would not
   render so that every surviving entry keeps the Back target it had. Back after