harden: escape every interpolation into popup innerHTML, and add default-src to both manifests (closes #307)

A hostile ERC-20's symbol() reached an innerHTML string unescaped, and neither
manifest declared default-src, so an attacker deploying a token with 1,000+
holders and airdropping one unit could render a full-viewport cross-origin
iframe over the wallet's own UI, on screens where the user types their
password.

escapeHtml is now a pure string replace over & < > " ' — the old version
round-tripped through textContent, which escapes neither quote, while already
being used inside data-copy="...". All 19 files in src/popup/views/ were
audited: beyond the reported symbol site, the explorer-supplied directionLabel
in all three transaction lists, wallet.name, addr.ensName, the blockie data:
URIs and two ad-hoc quote-only escapes were also unescaped. Explorer URLs now
go through one helper that percent-encodes the path segment.

Both manifests add default-src 'self', frame-src 'none', form-action 'none' and
base-uri 'none'. Three loosenings are pinned in tests/manifest.test.js and
justified in README.md: style-src 'unsafe-inline' (39 static style attributes;
Firefox implements neither style-src-attr nor 'unsafe-hashes'), img-src data:
(blockies), connect-src https: http: (user-configurable RPC).

Note frame-src 'none' blocks a frame loading, not the element existing, so the
zero-iframe assertion is a claim about the escaping alone; the test asserts the
element count and the literal rendered text separately, taking the count before
any click an overlay could intercept.

Verified: make check 39 suites / 811 tests, test-e2e 55/55 including the
WebAssembly-under-CSP assertion, test-e2e-firefox 8/8, zero CSP violations
asserted rather than merely unobserved. Reverting only balanceLine's
interpolation reproduces the attack as 2 iframes on the address screen.

README.md

@@ -1464,10 +1464,44 @@ policy, but as of now there are none.
 
 ### Content Security Policy
 
-Both manifests declare the same policy for extension pages —
-`script-src 'self' 'wasm-unsafe-eval'; object-src 'self'` — as an object under
+Both manifests declare the same policy for extension pages, as an object under
 `content_security_policy.extension_pages` in `manifest/chrome.json` (MV3) and as
-a bare string in `manifest/firefox.json` (MV2).
+a bare string in `manifest/firefox.json` (MV2):
+
+```
+default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; object-src 'self';
+style-src 'self' 'unsafe-inline'; img-src 'self' data:;
+connect-src 'self' https: http:; frame-src 'none'; form-action 'none';
+base-uri 'none'
+```
+
+`default-src 'self'` is the floor. Without it the policy governed script and
+plugins only, and everything else — frames above all — was unrestricted, which
+is what let an unescaped token symbol paint a cross-origin iframe over the
+wallet's own UI. Escaping is the primary fix for that (see
+`src/shared/html.js`); this is the second line, so an escape that does slip
+cannot reach the network.
+
+Four directives are looser than `'self'`, each for a reason that does not
+generalise:
+
+- `style-src 'unsafe-inline'` — `src/popup/index.html` and the view helpers set
+  presentation through `style="..."` attributes, which CSP blocks without this.
+  Chrome enforces `style-src` on attributes, not only on `<style>` blocks, and
+  Firefox has never implemented `style-src-attr`, so there is no narrower
+  spelling that works on both targets. It permits inline **style**; script stays
+  under `script-src`, which does not allow `'unsafe-inline'`.
+- `img-src data:` — identicons are generated in the popup by
+  `ethereum-blockies-base64` and assigned to `img.src` as `data:` PNGs.
+- `connect-src https: http:` — the RPC endpoint is user-configurable and a local
+  node over `http://127.0.0.1` is a supported configuration, which the Firefox
+  end-to-end suite depends on. The wallet's outbound traffic is constrained by
+  what it is written to contact (see External Communication), not by this
+  directive.
+- `frame-src 'none'`, `form-action 'none'`, `base-uri 'none'` — named rather
+  than inherited. `form-action` and `base-uri` do not fall back to `default-src`
+  at all, so they would have stayed unrestricted; `frame-src 'none'` is what
+  refuses the framed-overlay attack outright.
 
 `'wasm-unsafe-eval'` is there for one reason: libsodium. It ships a WebAssembly
 build and a `wasm2js` translation of it in one file, tries WASM first, and
@@ -1485,9 +1519,10 @@ strings, not inline script, not remote script. Using it requires already
 executing script in an extension page, which is complete compromise on its own.
 `'unsafe-eval'` is a different proposition and is not granted.
 
-The grant is pinned in both directions. `tests/manifest.test.js` asserts the
-exact token set in both manifests, so dropping `'wasm-unsafe-eval'` (a silent
-20x regression on the key derivation) and adding anything beyond it both fail
+The policy is pinned in both directions. `tests/manifest.test.js` asserts the
+exact directive set and the exact token set of each directive in both manifests,
+so dropping `'wasm-unsafe-eval'` (a silent 20x regression on the key
+derivation), dropping `default-src`, and adding anything anywhere all fail
 `make check`. `tests/vaultBackend.test.js` asserts the unit tests run the WASM
 backend, and `make test-e2e` compiles a WebAssembly module inside the real popup
 under the real manifest.