fix: Blockscout and Etherscan lookups are off until the user turns them on (closes #668)

Out of the box the wallet sent the user's addresses to Blockscout and each
recipient to Etherscan. Two settings, "Use Blockscout" and "Check recipients on
Etherscan", now gate those requests. Both are off in a new install and offered
unticked on Welcome and in Settings. While one is off, the screens that relied
on it say so in a plain line. Each gated request reads its setting from storage
before it asks and when the answer lands, and drops a late answer. An open popup
takes another page's change and draws its screens again. While "Use Blockscout"
is off, no address keeps an untracked token, and no screen names a token from
Blockscout's report. ENS lookups ask only the RPC endpoint.

Model: opus-5-5 (implementation); fable-5-1 (prose)

README.md

@@ -766,13 +766,11 @@ Three limits are worth knowing, all real differences from the Chrome suite:
   in `tests/e2e/dapp.js`, which serves the dApp page and a JSON-RPC node and
   which the extension's `rpcUrl` is pointed at for the dApp steps; a JSON-RPC
   method that fixture does not model fails the run rather than answering `null`.
-  Everything else, Blockscout and the price feed among it, has no fixture and
+  The suite leaves "Use Blockscout" off, so Blockscout is not asked. A
-  simply fails, and the extension swallows its own fetch failures, so only the
+  `ReferenceError` in the success path of `renderTransactions`, or of price
-  _failure_ branches of that code are ever executed. A `ReferenceError` in the
+  rendering, passes this suite green. The offline run is also weaker than the
-  success path of `renderTransactions`, or of price rendering, passes this suite
+  Chrome suite's interception for those calls: it proves nothing got out, but it
-  green. The offline run is also weaker than the Chrome suite's interception for
+  cannot report which requests were attempted.
-  those calls: it proves nothing got out, but it cannot report which requests
-  were attempted.
 - **The site-connection prompt always opens in a window of its own.** The
   profile turns off `extensions.openPopupWithoutUserGesture.enabled`, so
   `src/background/index.js` falls back from the toolbar popup, which WebDriver
@@ -2883,9 +2881,8 @@ Sent the user's data only while its setting is on:
         - on every balance refresh, in the popup and in the background
         - when Home, AddressDetail or AddressToken loads its history
         - when TransactionDetail opens
-    - **While the setting is off**: each of those screens shows a line saying
+    - **While the setting is off**: Each screen that would show Blockscout's
-      what the screen leaves out and that "Use Blockscout" is off. Only tracked
+      data says instead that the setting is off. Only tracked tokens are listed.
-      tokens are listed.
     - **Saving the URL**: pressing "Save" beside the URL in Settings asks that
       URL for `/stats`, whether or not the setting is on. This request carries
       no user data.