fix: tracked tokens are kept per network, and bundled picks are offered on mainnet only (closes #523)

A network switch puts the outgoing network's tracked tokens away in a new
persisted field, networkTrackedTokens, and brings back the incoming network's
list, or an empty one, as endpoints are kept; the background's switch uses the
same function. The two add-token screens offer their common-token picks on
Ethereum Mainnet only. After a switch in Settings, Back renders the screen it
lands on again, and the stack is cut at the first screen that cannot be
rendered from saved state, or at AddressToken for any token but the native
one; the cut stack is saved with the switch. ConfirmTx drawn again keeps the
network it was reviewed on. A contract lookup that answers after a switch adds
nothing.

Model: opus-5-5

README.md

@@ -1497,6 +1497,19 @@ such as an edit typed into Settings and not yet saved. Home is the one screen
 "Back" always re-renders, so the wallet list reflects anything that changed
 while the user was away from it.
 
+A network switch in Settings leaves every screen beneath Settings showing the
+previous network, so after it "Back" behaves as in a reopened popup: every
+screen on the stack counts as not yet rendered, and the stack is cut at the
+first screen that cannot be rendered from saved state, such as Send or AddToken,
+or at AddressToken for any token but the native one, because that token was
+picked on the previous network. The cut stack is saved with the switch, so a
+popup closed straight after it and reopened onto Settings lands in the same
+place. "Back" then renders the screen it lands on for the new network, except
+ConfirmTx, which keeps the network its transaction was reviewed on, and anything
+typed there and not saved, which belonged to the previous network, is dropped.
+Without a wallet the stack is not cut, because it starts at Welcome, which shows
+nothing from a network.
+
 Every screen that holds secret material in the page registers a cleanup with
 `onViewLeave()` (`src/popup/views/helpers.js`), which `showView()` runs on every
 exit from that screen rather than only on its "Back" button, so nothing secret
@@ -1794,19 +1807,22 @@ view would leave a wallet one click from deletion.
       it, and a disagreement is a refusal rather than a preference for either
       value (`src/shared/transferAmount.js`)
     - "Sign & Send" after the active network was switched in Settings since this
-      transaction was reviewed, with this screen open or before the popup
-      reopened onto it → nothing is signed; "The active network changed after
-      this transaction was reviewed, so it was not sent. Please go back and
-      review it again." in the errors box, no screen change. The transaction
-      carries the chain id of the network active when Send showed this screen,
-      and keeps it when the screen is drawn again from the saved transaction, so
-      it cannot be signed for another. The screen describes it on that network,
-      whichever network is active: its amounts are in that network's native
-      currency, its USD values are that network's, so a testnet transaction
-      shows none, its From, To and token contract links open that network's
-      explorer, the balance read, the fee estimate and the contract and
-      never-sent recipient checks ask that network's RPC endpoint, and the
-      Etherscan label check asks that network's explorer
+      transaction was reviewed → nothing is signed; "The active network changed
+      after this transaction was reviewed, so it was not sent. Please go back
+      and review it again." in the errors box, no screen change. After a switch,
+      "Back" from Settings draws this screen again from the saved transaction,
+      as a popup reopened onto it does; when Send is beneath it on the stack, as
+      when Send showed it in the same popup, "Back" lands below Send instead
+      (see the top of Screen Map). The transaction carries the chain id of the
+      network active when Send showed this screen, and keeps it when the screen
+      is drawn again from the saved transaction, so it cannot be signed for
+      another. The screen describes it on that network, whichever network is
+      active: its amounts are in that network's native currency, its USD values
+      are that network's, so a testnet transaction shows none, its From, To and
+      token contract links open that network's explorer, the balance read, the
+      fee estimate and the contract and never-sent recipient checks ask that
+      network's RPC endpoint, and the Etherscan label check asks that network's
+      explorer
     - "Sign & Send" (wrong password) → "Wrong password." on the password error
       line, no screen change
     - "Sign & Send" signs as the From address above, not as whichever address is
@@ -1944,13 +1960,18 @@ view would leave a wallet one click from deletion.
     - Contract address input
     - Status line ("Looking up token...", cleared or replaced on failure)
     - Common token quick-pick buttons (top 25 by market cap), which fill the
-      contract address input
+      contract address input. Shown on Ethereum Mainnet only, because the
+      bundled token list holds mainnet contracts
     - "Add" button
 - **Transitions**:
     - "Add" (valid contract) → tracks the token, pops the stack, and re-renders
       **AddressDetail**
     - "Add" with a token already tracked, a scam-listed address, or a failed
       contract lookup → flash message, no screen change
+    - "Add", then a network switch in Settings before the contract lookup
+      answers → nothing is tracked; "The active network changed before the
+      lookup finished, so the token was not added." flash message, no screen
+      change
     - "Back" → previous screen (AddressDetail)
 
 #### Settings (`settings`)
@@ -1961,16 +1982,19 @@ view would leave a wallet one click from deletion.
     - Wallets: one row per wallet with its name (tap to rename inline), a
       `[recovery phrase]` button on HD wallets only, and an `[x]` delete button,
       plus a "+ Add wallet" button
-    - Tracked Tokens: one row per tracked token with an `[x]` remove button,
-      plus a "+ Add token" button
+    - Tracked Tokens: one row per token tracked on the active network with an
+      `[x]` remove button, plus a "+ Add token" button
     - Display: "Show tracked tokens with zero balance" checkbox, "UTC
       Timestamps" checkbox, and a Theme selector (System / Light / Dark)
     - Network: network selector (Ethereum Mainnet / Sepolia Testnet). The
       network changes only here, or when the user approves a site's request on
       **NetworkApproval**; either way, switching restores the RPC and Blockscout
       endpoints last used on that network, or that network's defaults if it has
-      none, and sends `chainChanged` with the new chain id to every open tab.
-      Choosing the network already active changes nothing and sends nothing
+      none, and the tokens tracked on that network, and sends `chainChanged`
+      with the new chain id to every open tab. A token is tracked only on the
+      network it was added on, because a contract address names a token on one
+      network only. Choosing the network already active changes nothing and
+      sends nothing
     - Ethereum RPC: endpoint URL input + "Save" button (validated against
       `eth_chainId` before being saved)
     - Blockscout API: endpoint URL input + "Save" button (validated against
@@ -2015,7 +2039,8 @@ view would leave a wallet one click from deletion.
     - `[x]` on a denied site → forgets the refusal, in place; it connects
       nothing and tells the background nothing
     - Ten clicks on the version → reveals the Debug well (no screen change)
-    - "Back" (or Settings gear again) → previous screen (Home)
+    - "Back" (or Settings gear again) → previous screen (Home); after a network
+      switch, the stack is cut first (see the top of Screen Map)
 
 #### ShowRecoveryPhrase (`show-phrase`)
 
@@ -2198,7 +2223,8 @@ view would leave a wallet one click from deletion.
 #### SettingsAddToken (`settings-addtoken`)
 
 - **When**: User tapped "+ Add token" in Settings. Tokens added here are tracked
-  across every address, unlike AddToken which is reached from one address.
+  across every address on the active network, unlike AddToken which is reached
+  from one address.
 - **Elements**:
     - "Back" button, "Add Token" heading
     - Instruction text
@@ -2207,11 +2233,19 @@ view would leave a wallet one click from deletion.
     - "Or pick from top 100:" dropdown (already-tracked tokens are disabled) +
       "Add selected" button
     - "Or enter contract address:" input, a status line, and an "Add" button
+    - The two lists from the bundled token list, "Top tokens:" and "Or pick from
+      top 100:", are shown on Ethereum Mainnet only, because that list holds
+      mainnet contracts. On any other network the contract address is the only
+      add path
 - **Transitions**:
-    - Any of the three add paths, on success → adds the token and shows an
+    - Any of the add paths shown, on success → adds the token and shows an
       "Added SYMBOL" flash message (no screen change)
     - A duplicate, a scam-listed address, or a failed contract lookup → flash
       message, no screen change
+    - "Add" by contract address, then a network switch in Settings before the
+      lookup answers → nothing is tracked; "The active network changed before
+      the lookup finished, so the token was not added." flash message, no screen
+      change
     - "Back" → previous screen (Settings)
 
 #### SiteApproval (`approve-site`)
@@ -2426,8 +2460,9 @@ view would leave a wallet one click from deletion.
 - **Transitions**:
     - "Switch" → closes popup; the background switches the network as
       **Settings** does, restoring the RPC and Blockscout endpoints last used on
-      that network (or that network's defaults if it has none), sends
-      `chainChanged` to every open tab, and answers the site with success
+      that network (or that network's defaults if it has none) and the tokens
+      tracked on that network, sends `chainChanged` to every open tab, and
+      answers the site with success
     - "Reject" → closes popup; the site is answered with EIP-1193 code 4001 and
       nothing changes
     - Popup window closed without answering → the same as "Reject"