fix: Blockscout and Etherscan lookups are off until the user turns them on (closes #668)

Out of the box the wallet sent the user's addresses to Blockscout for history
and token lookups. It sent each recipient to Etherscan for its label. Two
settings, "Use Blockscout" and "Check recipients on Etherscan", now gate those
requests where they are made. Both are off in a new install and offered
unticked on Welcome and in Settings. While one is off, the screens that relied
on it say so in a plain line naming the setting. Unticking "Use Blockscout"
drops every untracked token from every address. After either changes in
Settings, Back draws again any screen a reopened popup can draw. ENS lookups
ask only the RPC endpoint.

Model: opus-5-5

tests/backgroundStateIsolation.test.js

@@ -410,7 +410,14 @@ describe("a balance refresh under a network switch", () => {
         const ranOn = [];
 
         const bg = loadWorker("sepolia", {
-            refreshBalances: async (wallets, rpcUrl, explorer, tokens, id) => {
+            refreshBalances: async (
+                wallets,
+                rpcUrl,
+                explorer,
+                useBlockscout,
+                tokens,
+                id,
+            ) => {
                 ranOn.push(id);
                 reachedNetwork.resolve();
                 await roundTrip.promise;
@@ -443,3 +450,60 @@ describe("a balance refresh under a network switch", () => {
         );
     });
 });
+
+describe("a balance refresh under a change of Use Blockscout", () => {
+    // Turning "Use Blockscout" off drops the tokens the user has not tracked
+    // (src/popup/views/settings.js). A refresh that started while it was on
+    // must not write them back when it returns. The same refresh in the popup
+    // is in tests/blockscoutEtherscanSettings.test.js.
+    test("a refresh that returns after Use Blockscout was turned off writes nothing", async () => {
+        const roundTrip = deferred();
+        const started = deferred();
+        const handed = [];
+
+        const bg = loadWorker("mainnet", {
+            refreshBalances: async (
+                wallets,
+                rpcUrl,
+                explorer,
+                useBlockscout,
+            ) => {
+                handed.push(useBlockscout);
+                started.resolve();
+                await roundTrip.promise;
+                wallets[0].addresses[0].tokenBalances = [
+                    {
+                        address: "0xAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
+                        name: "Test Token",
+                        symbol: "TST",
+                        decimals: 18,
+                        balance: "5.0",
+                        holders: 50000,
+                    },
+                ];
+            },
+        });
+        global.chrome.storage.write("autistmask", {
+            ...bg.persisted(),
+            useBlockscout: true,
+        });
+
+        const refresh = bg.fireBalanceAlarm();
+        await started.promise;
+
+        // The user unticks "Use Blockscout" in Settings while the round trip
+        // is out.
+        global.chrome.storage.write("autistmask", {
+            ...bg.persisted(),
+            useBlockscout: false,
+        });
+
+        roundTrip.resolve();
+        await refresh;
+
+        expect(handed).toEqual([true]);
+        const after = bg.persisted();
+        expect(after.wallets[0].addresses[0].tokenBalances).toEqual([]);
+        expect(after.lastBalanceRefresh).toBe(0);
+    });
+});