Add anti-poisoning filters for token transfers and send view

Three layers of defense against address poisoning attacks:

1. Known symbol verification: tokens claiming a symbol from the
   hardcoded top-250 list (e.g. "ETH", "USDT") but from an
   unrecognized contract are identified as spoofs and always hidden.
   Their contract addresses are auto-added to the fraud blocklist.

2. Low-holder filtering: tokens with <1000 holders are hidden from
   both transaction history and the send token selector. Controlled
   by the "Hide tokens with fewer than 1,000 holders" setting.

3. Fraud contract blocklist: a persistent local list of detected
   fraud contract addresses. Transactions involving these contracts
   are hidden. Controlled by the "Hide transactions from detected
   fraud contracts" setting.

Both settings default to on and can be disabled in Settings.
Fetching and filtering are separated: fetchRecentTransactions returns
raw data, filterTransactions is a pure function applying heuristics.
Token holder counts are now passed through from the Blockscout API.

src/popup/index.html

@@ -541,6 +541,32 @@
                     </button>
                 </div>
 
+                <div class="bg-well p-3 mx-1 mb-3">
+                    <h3 class="font-bold mb-1">Token Spam Protection</h3>
+                    <p class="text-xs text-muted mb-2">
+                        Scammers deploy fake token contracts that emit spoofed
+                        Transfer events to plant look-alike addresses in your
+                        transaction history. These filters hide fraudulent
+                        transfers and prevent interaction with suspicious
+                        tokens.
+                    </p>
+                    <label
+                        class="text-xs flex items-center gap-1 cursor-pointer mb-1"
+                    >
+                        <input type="checkbox" id="settings-hide-low-holders" />
+                        Hide tokens with fewer than 1,000 holders
+                    </label>
+                    <label
+                        class="text-xs flex items-center gap-1 cursor-pointer"
+                    >
+                        <input
+                            type="checkbox"
+                            id="settings-hide-fraud-contracts"
+                        />
+                        Hide transactions from detected fraud contracts
+                    </label>
+                </div>
+
                 <div class="bg-well p-3 mx-1 mb-3">
                     <h3 class="font-bold mb-1">Allowed Sites</h3>
                     <p class="text-xs text-muted mb-2">