harden: escape every interpolation into popup innerHTML, and add default-src to both manifests (closes #307)

A hostile ERC-20's symbol() reached an innerHTML string unescaped, and neither
manifest declared default-src, so an attacker deploying a token with 1,000+
holders and airdropping one unit could render a full-viewport cross-origin
iframe over the wallet's own UI, on screens where the user types their
password.

escapeHtml is now a pure string replace over & < > " ' — the old version
round-tripped through textContent, which escapes neither quote, while already
being used inside data-copy="...". All 19 files in src/popup/views/ were
audited: beyond the reported symbol site, the explorer-supplied directionLabel
in all three transaction lists, wallet.name, addr.ensName, the blockie data:
URIs and two ad-hoc quote-only escapes were also unescaped. Explorer URLs now
go through one helper that percent-encodes the path segment.

Both manifests add default-src 'self', frame-src 'none', form-action 'none' and
base-uri 'none'. Three loosenings are pinned in tests/manifest.test.js and
justified in README.md: style-src 'unsafe-inline' (39 static style attributes;
Firefox implements neither style-src-attr nor 'unsafe-hashes'), img-src data:
(blockies), connect-src https: http: (user-configurable RPC).

Note frame-src 'none' blocks a frame loading, not the element existing, so the
zero-iframe assertion is a claim about the escaping alone; the test asserts the
element count and the literal rendered text separately, taking the count before
any click an overlay could intercept.

Verified: make check 39 suites / 811 tests, test-e2e 55/55 including the
WebAssembly-under-CSP assertion, test-e2e-firefox 8/8, zero CSP violations
asserted rather than merely unobserved. Reverting only balanceLine's
interpolation reproduces the attack as 2 iframes on the address screen.

src/popup/views/settings.js

@@ -4,6 +4,7 @@ const {
     updateDebugBanner,
     showFlash,
     escapeHtml,
+    displaySymbol,
     flashCopyFeedback,
     goBack,
     pushCurrentView,
@@ -43,8 +44,11 @@ function renderSiteList(containerId, siteMap, stateKey) {
     let html = "";
     hostnames.forEach((hostname) => {
         html += `<div class="flex justify-between items-center text-xs py-1 border-b border-border-light">`;
-        html += `<span>${hostname}</span>`;
-        html += `<button class="btn-remove-site border border-border px-1 hover:bg-fg hover:text-bg cursor-pointer" data-key="${stateKey}" data-hostname="${hostname}">[x]</button>`;
+        // A hostname the URL parser produced cannot carry a delimiter, so
+        // this is escaped for the rule rather than for a known hole — the
+        // rule being that nothing reaches innerHTML unescaped.
+        html += `<span>${escapeHtml(hostname)}</span>`;
+        html += `<button class="btn-remove-site border border-border px-1 hover:bg-fg hover:text-bg cursor-pointer" data-key="${escapeHtml(stateKey)}" data-hostname="${escapeHtml(hostname)}">[x]</button>`;
         html += `</div>`;
     });
     container.innerHTML = html;
@@ -73,9 +77,10 @@ function renderTrackedTokens() {
     }
     let html = "";
     state.trackedTokens.forEach((token, idx) => {
+        const sym = escapeHtml(displaySymbol(token.symbol));
         const label = token.name
-            ? escapeHtml(token.name) + " (" + escapeHtml(token.symbol) + ")"
-            : escapeHtml(token.symbol);
+            ? escapeHtml(token.name) + " (" + sym + ")"
+            : sym;
         html += `<div class="flex justify-between items-center text-xs py-1 border-b border-border-light">`;
         html += `<span>${label}</span>`;
         html += `<button class="btn-remove-token border border-border px-1 hover:bg-fg hover:text-bg cursor-pointer" data-idx="${idx}">[x]</button>`;