Add basic monochrome popup UI with Tailwind CSS

Black-on-white, monospace, Universal Paperclips aesthetic.
All views: lock, setup/create/import, main account, send,
receive, add token, settings, and approval. Vanilla JS view
switching with stub state. README updated with full UI design
philosophy, external services documentation, and view descriptions.

README.md

@@ -55,7 +55,7 @@ src/
     index.html
     index.js
     components/     — UI components (account list, send form, etc.)
-    styles/         — CSS
+    styles/         — CSS (Tailwind)
   content/          — content script injected into web pages
     index.js        — injects the provider into page context
     inpage.js       — the window.ethereum provider object
@@ -69,6 +69,85 @@ manifest/
   firefox.json      — Manifest V2/V3 for Firefox
 ```
 
+### UI Design Philosophy
+
+The UI follows a "Universal Paperclips" aesthetic — a deliberately spartan,
+almost brutalist approach:
+
+- **Monochrome**: Black text on white background. No brand colors, no gradients,
+  no color-coding. Color may be introduced later for specific semantic purposes
+  (e.g. error states) but the baseline is monochrome.
+- **Text-first**: Every piece of information is presented as text. Balances are
+  numbers. Addresses are hex strings. Status is a sentence. No progress spinners
+  with animations — a text status line is sufficient.
+- **Monospace font**: All text is rendered in the system monospace font.
+  Ethereum addresses, transaction hashes, and balances are inherently
+  fixed-width data. Rather than mixing proportional and monospace fonts, we use
+  monospace everywhere for visual consistency and alignment.
+- **Icon fonts only**: Where icons are needed (copy, send, settings, etc.) we
+  use an icon font (no SVGs, no PNGs, no image assets). This keeps the extension
+  size tiny and the build simple.
+- **No images**: Zero image assets in the entire extension. No logos, no
+  illustrations, no token icons. Token identity is conveyed by symbol text (ETH,
+  USDC, etc.).
+- **Tailwind CSS**: Utility-first CSS via Tailwind. No custom CSS classes for
+  styling. Tailwind is configured with a minimal monochrome palette. This keeps
+  the styling co-located with the markup and eliminates CSS file management.
+- **Vanilla JS**: No framework (React, Vue, Svelte, etc.). The popup UI is small
+  enough that vanilla JS with simple view switching is sufficient. A framework
+  would add bundle size, build complexity, and attack surface for no benefit at
+  this scale.
+- **360x600 popup**: Standard browser extension popup dimensions. The UI is
+  designed for this fixed viewport — no responsive breakpoints needed.
+
+### UI Views
+
+The popup has the following views, switched via simple show/hide:
+
+1. **Lock screen**: Password input + unlock button. Shown when the wallet is
+   locked or on first open after browser restart.
+2. **Setup / Onboarding**: Shown on first use. Create a new wallet (generates
+   BIP-39 mnemonic, user confirms backup, sets password) or import an existing
+   seed phrase.
+3. **Main / Account view**: The default view after unlock. Shows the current
+   account address (truncated, click to copy), ETH balance, list of added ERC-20
+   tokens with balances, and action buttons (Send, Receive, Settings).
+4. **Send**: Form with To address, amount, token selector (ETH or any added
+   ERC-20), and a Send button. Shows gas estimate before confirming.
+5. **Receive**: Displays the current account address in full (copyable). That's
+   it.
+6. **Settings**: Configure RPC endpoint URL, manage wallets (add/remove seed
+   phrases), derive additional accounts, view/export seed phrase (requires
+   password re-entry), manage added ERC-20 tokens.
+7. **Approval popups**: When a connected site requests a transaction signature
+   or message signature, an approval view shows the details and Approve/Reject
+   buttons.
+
+### External Services
+
+AutistMask is not a fully self-contained offline tool. It necessarily
+communicates with external services to function as a wallet:
+
+- **Ethereum JSON-RPC endpoint**: The extension needs an Ethereum node to query
+  balances (`eth_getBalance`), read ERC-20 token contracts (`eth_call`),
+  estimate gas (`eth_estimateGas`), fetch nonces (`eth_getTransactionCount`),
+  broadcast transactions (`eth_sendRawTransaction`), and check transaction
+  receipts. The default endpoint is a public RPC (configurable by the user to
+  any endpoint they prefer, including a local node). This is the only external
+  service the extension talks to.
+
+What the extension does NOT do:
+
+- No analytics or telemetry services
+- No token list APIs (user adds tokens manually by contract address)
+- No price feed APIs (balances are shown in token units, not fiat)
+- No phishing/blocklist APIs
+- No Infura/Alchemy dependency (any JSON-RPC endpoint works)
+- No backend servers operated by the developer
+
+The user's RPC endpoint is the single point of external communication. Users who
+want maximum privacy can point it at their own Ethereum node.
+
 ### Key Decisions
 
 - **No framework**: The popup UI is vanilla JS and HTML. The extension is small
@@ -85,9 +164,6 @@ manifest/
 - **Minimal RPC**: The extension communicates with Ethereum nodes via JSON-RPC.
   The default endpoint is configurable. No Infura dependency — users can point
   it at any Ethereum JSON-RPC endpoint.
-- **No external services**: No analytics, no tracking, no telemetry, no ads, no
-  phishing lists, no token price feeds. The extension only talks to the
-  configured Ethereum RPC endpoint.
 
 ### Supported Functionality
 
@@ -109,24 +185,29 @@ manifest/
 ### Non-Goals
 
 - Token swaps (use a DEX in the browser)
-- Portfolio/price tracking
+- Portfolio/price tracking (balances shown in token units only, no fiat)
 - NFT display or management
 - Multi-chain support (Ethereum mainnet only, for now)
 - Analytics, telemetry, or tracking of any kind
 - Advertisements or promotions
 - Phishing detection (use your brain)
 - Hardware wallet support (maybe later)
+- Token list auto-discovery (user adds tokens manually)
+- Fiat on/off ramps
+- Browser notifications
+- Transaction history (use Etherscan)
 
 ## TODO
 
-- [ ] Set up build system (webpack/esbuild) for Chrome and Firefox targets
+- [x] Project scaffolding (Makefile, Dockerfile, CI, manifests)
+- [ ] Set up Tailwind CSS build pipeline
+- [ ] Build popup UI views (lock, setup, main, send, receive, settings)
 - [ ] Implement BIP-39 mnemonic generation and validation
 - [ ] Implement BIP-32/BIP-44 HD key derivation for Ethereum
 - [ ] Implement encrypted storage for seed phrases
-- [ ] Build popup UI: lock screen, account list, send/receive views
 - [ ] Implement background wallet manager
 - [ ] Implement EIP-1193 provider and content script injection
-- [ ] Implement ETH send/receive
+- [ ] Implement ETH balance lookup and send
 - [ ] Implement ERC-20 token management (add by contract, view balance, send)
 - [ ] Implement site connection approval flow
 - [ ] Implement transaction signing approval flow