fix: the bundled token list names tokens on Ethereum Mainnet only (closes #632)

bundledToken(address, chainId) in tokenList.js answers only for Ethereum
Mainnet's chain id. Every reader of TOKEN_BY_ADDRESS now goes through it,
with the chain id of the transaction, balance or history entry it draws.
The token sources the screens build carry that chain id. The Uniswap
decoder sets the transaction's chain id on them. fetchTokenBalances()
takes the chain id of the network it asks about.

isSpoofedSymbol() takes the chain id of the token's network. It checks the
bundled list's symbols only on Ethereum Mainnet. The native asset's labels
stay reserved on every network.

Eighteen existing tests and three shared test helpers read the bundled
list without naming a network. Each now names Ethereum Mainnet.

Model: opus-5-5

tests/transactions.test.js

@@ -144,6 +144,7 @@ function tokenTx(overrides = {}) {
         isError: false,
         contractAddress: USDC_CONTRACT,
         holders: 3500000,
+        chainId: "0x1",
         ...overrides,
     };
 }
@@ -259,6 +260,32 @@ describe("known-symbol spoof verification", () => {
         expect(result.newFraudContracts).toEqual([NOVEL_SPAM_CONTRACT]);
     });
 
+    // https://git.eeqj.de/sneak/AutistMask/issues/632: the bundled list holds
+    // mainnet contracts, so its symbols are not known symbols on Sepolia.
+    test("on Sepolia, a bundled symbol from another contract is kept", () => {
+        const sepoliaToken = tokenTx({
+            symbol: "USDC",
+            contractAddress: NOVEL_SPAM_CONTRACT,
+            holders: 5000000,
+            chainId: "0xaa36a7",
+        });
+        const result = filterTransactions([sepoliaToken], filters());
+        expect(result.transactions).toEqual([sepoliaToken]);
+        expect(result.newFraudContracts).toEqual([]);
+    });
+
+    test('on Sepolia, "ETH" as an ERC-20 is still spoofed', () => {
+        const fakeEth = tokenTx({
+            symbol: "ETH",
+            contractAddress: NOVEL_SPAM_CONTRACT,
+            holders: 5000000,
+            chainId: "0xaa36a7",
+        });
+        expect(filterTransactions([fakeEth], filters()).transactions).toEqual(
+            [],
+        );
+    });
+
     test("the genuine contract for that symbol is not spoofed", () => {
         const genuine = tokenTx();
         const result = filterTransactions([genuine], filters());
@@ -1495,6 +1522,41 @@ describe("fetchRecentTransactions merge and dedup", () => {
         expect(mainnet[0].chainId).toBe("0x1");
     });
 
+    // https://git.eeqj.de/sneak/AutistMask/issues/632: the bundled token list
+    // names a contract only on Ethereum Mainnet. On Sepolia, a call to the
+    // contract at USDC's mainnet address is labelled with the network's native
+    // currency. A call to any contract the wallet does not name gets that label.
+    test("a contract call on Sepolia is not named by the bundled list", async () => {
+        respondWith(
+            [
+                {
+                    hash: "0x" + "b".repeat(64),
+                    block_number: 21000095,
+                    timestamp: TS,
+                    from: { hash: VICTIM },
+                    to: { hash: USDC_CONTRACT, is_contract: true },
+                    value: "0",
+                    method: "approve",
+                    status: "ok",
+                },
+            ],
+            [],
+        );
+        const sepolia = await fetchRecentTransactions(
+            VICTIM,
+            BLOCKSCOUT,
+            "0xaa36a7",
+        );
+        expect(sepolia[0].directionLabel).toBe("Approve");
+        expect(sepolia[0].symbol).toBe("SepoliaETH");
+        const mainnet = await fetchRecentTransactions(
+            VICTIM,
+            BLOCKSCOUT,
+            "0x1",
+        );
+        expect(mainnet[0].symbol).toBe("USDC");
+    });
+
     test("the fake token transfer survives fetching and is then filtered", async () => {
         respondWith(
             [],