fix: only the user switches the wallet's network (closes #408)

A connected site's wallet_switchEthereumChain request for the other
supported network now opens a prompt in its own window, through the
existing approval machinery, naming the site and both networks. The
network, endpoints, balances and caches change, and chainChanged is
sent, only when the user approves it; rejecting or closing the prompt
answers 4001. One such prompt per site at a time; a request for the
active network needs none. The approval window no longer shows the
connection prompt while it waits for the approval's description,
since both prompts answer on the same port.

Model: opus-5-5

src/popup/index.html

@@ -1741,6 +1741,54 @@
                 </div>
             </div>
 
+            <!-- ============ NETWORK SWITCH APPROVAL ============ -->
+            <div id="view-approve-network" class="view hidden">
+                <h2 class="font-bold mb-2">Network Switch Request</h2>
+                <div
+                    id="approve-network-phishing-warning"
+                    class="mb-3 p-2 text-xs font-bold hidden bg-red-100 text-red-800 border-2 border-red-600 rounded-md"
+                >
+                    ⚠️ PHISHING WARNING: This site is on a known phishing
+                    blocklist. Proceed with extreme caution.
+                </div>
+                <p class="mb-2">
+                    <span id="approve-network-origin" class="font-bold"></span>
+                    wants to switch the wallet's network.
+                </p>
+                <div class="mb-3">
+                    <div class="text-xs text-muted mb-1">Current network</div>
+                    <div
+                        id="approve-network-current"
+                        class="text-xs font-bold"
+                    ></div>
+                </div>
+                <div class="mb-3">
+                    <div class="text-xs text-muted mb-1">Requested network</div>
+                    <div
+                        id="approve-network-requested"
+                        class="text-xs font-bold"
+                    ></div>
+                </div>
+                <p class="mb-3 text-xs">
+                    Switching changes the network for the whole wallet and for
+                    every site, not only for this one.
+                </p>
+                <div class="flex justify-between">
+                    <button
+                        id="btn-approve-network"
+                        class="border border-border px-2 py-1 hover:bg-fg hover:text-bg cursor-pointer"
+                    >
+                        Switch
+                    </button>
+                    <button
+                        id="btn-reject-network"
+                        class="border border-border px-2 py-1 hover:bg-fg hover:text-bg cursor-pointer"
+                    >
+                        Reject
+                    </button>
+                </div>
+            </div>
+
             <!-- ============ STATE RECOVERY ============ -->
             <!--
                 Shown when the stored profile cannot be read at all. Every