fix: add a Settings toggle for known-symbol spoof verification (closes #176)

The README promises all four token-spam filters "default to on but can be
individually disabled". Known-symbol spoof verification had no state flag, no
checkbox and no consulted setting: filterTransactions() applied it before any
filter setting was read, so three of the four documented filters were
configurable and the fourth was mandatory.

Adds hideSpoofedSymbols, default on, persisted and migrated so a profile
written before the setting existed loads it as on rather than undefined. The
flag is fail-safe in the pure function too: only an explicit false disables
the check, so a caller that omits the key keeps it.

Turning the setting off also stops the fraud-contract learning. That learning
is fed only by this check, and leaving it on would make the setting a no-op:
the contract it recorded would hide the very row the user asked to see, via
the fraud-contract rule that is on by default.

Scope: the setting governs the transaction history. The same check on the
balance list and the send-screen token selector stays unconditional — those
decide which tokens the user can act on, not what the history displays. The
README's user-configurable paragraph now states what each of the four
settings actually reaches, which is not uniform.

The two `current behaviour:` tests pinning the filter as undisableable are
inverted rather than deleted, and joined by coverage for the bypass, the
halted learning, the untouched sibling rules and the storage round-trip.

src/shared/state.js

@@ -21,6 +21,7 @@ const DEFAULT_STATE = {
     deniedSites: {},
     rememberSiteChoice: true,
     showZeroBalanceTokens: true,
+    hideSpoofedSymbols: true,
     hideLowHolderTokens: true,
     hideFraudContracts: true,
     hideDustTransactions: true,
@@ -61,6 +62,7 @@ async function saveState() {
         deniedSites: state.deniedSites,
         rememberSiteChoice: state.rememberSiteChoice,
         showZeroBalanceTokens: state.showZeroBalanceTokens,
+        hideSpoofedSymbols: state.hideSpoofedSymbols,
         hideLowHolderTokens: state.hideLowHolderTokens,
         hideFraudContracts: state.hideFraudContracts,
         hideDustTransactions: state.hideDustTransactions,
@@ -112,6 +114,12 @@ async function loadState() {
             saved.showZeroBalanceTokens !== undefined
                 ? saved.showZeroBalanceTokens
                 : true;
+        // A profile written before this setting existed has no key for it.
+        // It is a safety filter, so absent must load as on, not as undefined.
+        state.hideSpoofedSymbols =
+            saved.hideSpoofedSymbols !== undefined
+                ? saved.hideSpoofedSymbols
+                : true;
         state.hideLowHolderTokens =
             saved.hideLowHolderTokens !== undefined
                 ? saved.hideLowHolderTokens