fix: move the UTC Timestamps checkbox into the Display well (closes #212)

The `settings-utc-timestamps` checkbox sat inside the Token Spam Protection
well, immediately after the dust-threshold input. It is a display preference
and has nothing to do with spam filtering, so it now renders in the Display
well next to the theme selector.

Markup move only. The checkbox is wired by id — `$("settings-utc-timestamps")`
in `src/popup/views/settings.js`, where `$` is `document.getElementById` — for
both the initial `checked` assignment and the `change` handler, so nothing in
the wiring depends on the element's parent or siblings. `state.utcTimestamps`,
`saveState`/`loadState` and the `helpers.js` formatting path are untouched.

Both Settings descriptions follow the markup: the `README.md` Screen Map and
the `docs/README.md` Settings list each now name the UTC control under Display
and no longer under Token Spam Protection.

`tests/settingsUtcTimestamps.test.js` pins both halves down: the checkbox
appears exactly once and inside the Display well rather than the spam well,
and the setting still round-trips through storage.

TODO.md

@@ -44,6 +44,9 @@ undefined identifiers, which is how
 
 # Completed Steps
 
+- 2026-08-11: UTC Timestamps checkbox moved from the Token Spam Protection well
+  into Display, next to the theme selector
+  ([#212](https://git.eeqj.de/sneak/AutistMask/issues/212)).
 - 2026-08-11: Policy compliance sweep — conditional verbose test rerun, local
   Tailwind binary instead of `npx`, `--frozen-lockfile` on `make install`, and
   the Makefile-only targets documented in the README