refactor: vendor phishing blocklist, delta-only memory model

- Vendor community-maintained phishing domain blocklist into
  src/shared/phishingBlocklist.json (bundled at build time by esbuild)
- Refactor phishingDomains.js: build vendored Sets at module load,
  fetch live list periodically, keep only delta (new entries not in
  vendored) in memory for small runtime footprint
- Domain checker checks delta first (fresh scam sites), then vendored
- Persist delta to localStorage if under 256 KiB
- Load delta from localStorage on startup for instant coverage
- Add startPeriodicRefresh() with 24h setInterval in background script
- Remove dead code: popup's local isPhishingDomain() re-check was inert
  (popup never called updatePhishingList so its blacklistSet was always
  empty); now relies solely on background's authoritative flag
- Remove all competitor name mentions from UI warning text and comments
- Update README: document phishing domain protection architecture,
  update external services list
- Update tests: cover vendored blocklist loading, delta computation,
  localStorage persistence, delta+vendored interaction

Closes #114

src/popup/index.html

@@ -1192,7 +1192,7 @@
                     id="approve-tx-phishing-warning"
                     class="mb-3 p-2 text-xs font-bold hidden bg-red-100 text-red-800 border-2 border-red-600 rounded-md"
                 >
-                    ⚠️ PHISHING WARNING: This site is on MetaMask's phishing
+                    ⚠️ PHISHING WARNING: This site is on a known phishing
                     blocklist. This transaction may steal your funds. Proceed
                     with extreme caution.
                 </div>
@@ -1266,7 +1266,7 @@
                     id="approve-sign-phishing-warning"
                     class="mb-3 p-2 text-xs font-bold hidden bg-red-100 text-red-800 border-2 border-red-600 rounded-md"
                 >
-                    ⚠️ PHISHING WARNING: This site is on MetaMask's phishing
+                    ⚠️ PHISHING WARNING: This site is on a known phishing
                     blocklist. Signing this message may authorize theft of your
                     funds. Proceed with extreme caution.
                 </div>
@@ -1343,7 +1343,7 @@
                     id="approve-site-phishing-warning"
                     class="mb-3 p-2 text-xs font-bold hidden bg-red-100 text-red-800 border-2 border-red-600 rounded-md"
                 >
-                    ⚠️ PHISHING WARNING: This site is on MetaMask's phishing
+                    ⚠️ PHISHING WARNING: This site is on a known phishing
                     blocklist. Connecting your wallet may result in loss of
                     funds. Proceed with extreme caution.
                 </div>

src/popup/views/approval.js

@@ -13,8 +13,6 @@ const { ERC20_ABI } = require("../../shared/constants");
 const { TOKEN_BY_ADDRESS } = require("../../shared/tokenList");
 const txStatus = require("./txStatus");
 const uniswap = require("../../shared/uniswap");
-const { isPhishingDomain } = require("../../shared/phishingDomains");
-
 const runtime =
     typeof browser !== "undefined" ? browser.runtime : chrome.runtime;
 
@@ -156,11 +154,12 @@ function decodeCalldata(data, toAddress) {
     return null;
 }
 
-function showPhishingWarning(elementId, hostname, isPhishing) {
+function showPhishingWarning(elementId, isPhishing) {
     const el = $(elementId);
     if (!el) return;
-    // Check both the flag from background and a local re-check
-    if (isPhishing || isPhishingDomain(hostname)) {
+    // The background script performs the authoritative phishing domain check
+    // and passes the result via the isPhishingDomain flag.
+    if (isPhishing) {
         el.classList.remove("hidden");
     } else {
         el.classList.add("hidden");
@@ -170,7 +169,6 @@ function showPhishingWarning(elementId, hostname, isPhishing) {
 function showTxApproval(details) {
     showPhishingWarning(
         "approve-tx-phishing-warning",
-        details.hostname,
         details.isPhishingDomain,
     );
 
@@ -343,7 +341,6 @@ function formatTypedDataHtml(jsonStr) {
 function showSignApproval(details) {
     showPhishingWarning(
         "approve-sign-phishing-warning",
-        details.hostname,
         details.isPhishingDomain,
     );
 
@@ -409,7 +406,6 @@ function show(id) {
         // Site connection approval
         showPhishingWarning(
             "approve-site-phishing-warning",
-            details.hostname,
             details.isPhishingDomain,
         );
         $("approve-hostname").textContent = details.hostname;