fix: fold invisible characters before the known-symbol spoof check (closes #260)

A token calling itself " ETH " missed the known-symbol table entirely, so the
spoof check reported it was not a spoof -- while HTML collapsed the whitespace
and displayed it as ETH next to the user's real ETH. One space defeated the
filter.

The symbol is now folded before the lookup: NFKC, remove what paints nothing,
trim, uppercase. The rule is "remove what paints nothing"; the Unicode classes
are how that is spelled, which is why U+007F is named separately -- it is a
control, reached by no class, and measures identical to no character at all.

Every width in the module comment was measured in the pinned browser rather
than reasoned about, and the boundary is pinned from both sides: widening to
all control characters fails the visible-controls test, narrowing back fails
the invisible-characters test. Two default-ignorable code points do paint a
box and are folded anyway, which can only hide a token that does not resemble
the symbol it folds to -- the harmless direction, recorded rather than glossed.

Confusables that are distinct letters, bidi reordering and interior whitespace
are knowingly left open and asserted open by tests.

TODO.md

@@ -45,6 +45,20 @@ undefined identifiers, which is how
 
 # Completed Steps
 
+- 2026-08-12: The known-symbol spoof rule now judges the symbol a user actually
+  sees. `isSpoofedSymbol()` normalizes before the lookup — NFKC, then every
+  character that paints nothing removed (the format and default-ignorable
+  characters, plus U+007F), then trimmed — so `" ETH "`, a no-break space, a
+  zero-width space, a Hangul filler, a variation selector, a DELETE and a
+  fullwidth `ＥＴＨ` are all caught on the balance list, the history and the
+  send selector at once. Confusables that are distinct letters (Cyrillic `Е`),
+  bidi reordering and the visible C0/C1 controls — which measure 48.00px, a box,
+  in the pinned e2e Chromium where an invisible prefix measures 32.00px — stay
+  knowingly open and are asserted as open in the suite. No bundled symbol
+  contains whitespace or a non-ASCII character, so nothing legitimate is newly
+  filtered; the balance list's token-type gate also became case-insensitive,
+  which no longer drops a real holding if an explorer writes `erc-20`
+  ([#260](https://git.eeqj.de/sneak/AutistMask/issues/260)).
 - 2026-08-12: A containerized Firefox end-to-end harness
   (`make test-e2e-firefox`) drives the real popup in a real Firefox with the MV2
   build installed as a temporary add-on. Zero npm dependencies — a WebDriver