fix: every balance is cut to four decimals (closes #757)

The balance lists and Home's ETH line rounded with toFixed(4), so 0.99996
ETH read 1.0000 there and 0.9999 on Send. Send's current balance and
ConfirmTx's balance line kept the nonzero floor, so 0.00004 USDC read
0.0000 in the lists and 0.00004 on Send. All four now cut the stored
decimal string with truncateAmount(), as the history rows do.
balanceLine() takes the stored balance string instead of a parsed number,
and escapes the quantity cell. The amounts, fees and allowances a screen
asks the user to approve keep the floor of truncateAmountNeverZero().

Disclosure: for a holding below 0.0001, ConfirmTx shows the amount sent
beside a balance that reads 0.0000.

Model: opus-5-5

tests/balanceLineEscaping.test.js

@@ -41,13 +41,13 @@ describe("balanceLine", () => {
         // this payload before its id attribute, so an assertion about the
         // rest of the payload would pass on the cap and say nothing about
         // the escape.
-        const html = balanceLine(HOSTILE_SYMBOL, 1, null, null);
+        const html = balanceLine(HOSTILE_SYMBOL, "1", null, null);
         expect(html).not.toContain("<iframe");
         expect(html).toContain("&lt;iframe");
     });
 
     test("caps the symbol before rendering it", () => {
-        const html = balanceLine("A".repeat(4096), 1, null, null);
+        const html = balanceLine("A".repeat(4096), "1", null, null);
         expect(html).toContain("A".repeat(MAX_SYMBOL_LENGTH - 1) + "…");
         expect(html).not.toContain("A".repeat(MAX_SYMBOL_LENGTH + 1));
     });
@@ -55,13 +55,13 @@ describe("balanceLine", () => {
     // The token id lands inside data-token="...", so a quote in it is a
     // way out of the attribute and into a new one.
     test("keeps a quote-bearing token id inside its attribute", () => {
-        const html = balanceLine("TKN", 1, null, '" onclick="alert(1)');
+        const html = balanceLine("TKN", "1", null, '" onclick="alert(1)');
         expect(html).not.toContain('onclick="');
         expect(html).toContain('data-token="&quot; onclick=&quot;alert(1)"');
     });
 
     test("renders an ordinary holding unchanged", () => {
-        const html = balanceLine("USDC", 1.5, null, "0xabc");
+        const html = balanceLine("USDC", "1.5", null, "0xabc");
         expect(html).toContain("<span>USDC</span>");
         expect(html).toContain("<span>1.5000</span>");
         expect(html).toContain('data-token="0xabc"');
@@ -69,7 +69,7 @@ describe("balanceLine", () => {
 
     // formatUsd() writes a value under a cent as "< $0.01".
     test("escapes the USD value along with the symbol", () => {
-        const html = balanceLine("USDC", 0.001, 1, null);
+        const html = balanceLine("USDC", "0.001", 1, null);
         expect(html).toContain("&lt; $0.01");
         expect(html).not.toContain("< $0.01");
     });