fix: run libsodium on WebAssembly under the extension CSP (closes #182)

libsodium ships a WASM build and a wasm2js translation in one file, tries
WASM first, and silently falls back if instantiation throws. Under a plain
script-src 'self' the fallback was taken on every popup load, announced by
nothing but an uncaught CompileError.

Measured on the vault's own Argon2id parameters (OPSLIMIT_INTERACTIVE,
MEMLIMIT_INTERACTIVE), node 22: WASM 141-198ms per derivation, wasm2js
3204-3660ms. The work factor is identical either way — it is set by the
ops and memory parameters, not by wall time — so the fallback bought no
security and cost about 3.5s on every operation that asks for the
password, which is every signature.

Both manifests now declare script-src 'self' 'wasm-unsafe-eval';
object-src 'self' for extension pages: an object under
content_security_policy.extension_pages for Chrome MV3, a bare string for
Firefox MV2. The keyword permits compiling WebAssembly and nothing else —
not eval() of strings, not inline script, not remote script — and reaching
it requires already executing script in an extension page. 'unsafe-eval'
is not granted.

The silence is what made this dangerous, so the fallback is now loud at
three levels: tests/manifest.test.js pins both policies to exactly that
token set, failing make check if the grant is dropped or if anything is
added beside it; tests/vaultBackend.test.js asserts the unit tests
exercise the WASM backend, with a self-validating check that libsodium
never swapped its fallback in; and the e2e suite compiles a WebAssembly
module inside the real popup under the real manifest, with the harness
allowlist entry that used to excuse the CompileError now deleted.

The runtime fallback itself is kept — a wallet that refuses to decrypt is
worse than a slow one — but vault.js now reports the backend and logs an
error when it is not WASM.

README.md

@@ -444,9 +444,9 @@ The core hierarchy is **Wallets → Addresses**:
 Which tokens an address shows is decided by `fetchTokenBalances()` in
 `src/shared/balances.js`, from the Blockscout `token-balances` response, so
 tokens do appear without the user adding them. An ERC-20 is shown when its
-balance is nonzero and it is in the bundled known-token list, is tracked by the
+balance is nonzero and it is in the bundled top-250 token list, is tracked by
-user, or has 1,000 or more holders; a token claiming a symbol from the bundled
+the user, or has 1,000 or more holders; a token claiming a symbol from the
-list from any other contract address is always dropped. That filter is
+bundled list from any other contract address is always dropped. That filter is
 unconditional — the "Hide tokens with fewer than 1,000 holders" setting governs
 the transaction history and the send-screen token selector, not this list.
 Tracked tokens with a zero balance are listed as well while "Show tracked tokens
@@ -1009,7 +1009,7 @@ communicates with three external services to function as a wallet:
 What the extension does NOT do:
 
 - No analytics or telemetry services
-- No token list APIs (the known-token list is bundled at build time)
+- No token list APIs (the top-250 token list is bundled at build time)
 - No Infura/Alchemy dependency (any JSON-RPC endpoint works)
 - No backend servers operated by the developer
 
@@ -1167,8 +1167,8 @@ hardcoded test phrase.
 - Add multiple addresses within an HD wallet
 - Manage multiple wallets simultaneously
 - View ETH balance per address
-- View ERC-20 token balances (tokens on the bundled known-token list, tokens
+- View ERC-20 token balances (bundled top-250 tokens, tokens with 1,000 or more
-  with 1,000 or more holders, and tokens the user adds by contract address)
+  holders, and tokens the user adds by contract address)
 - Send ETH to an address
 - Send ERC-20 tokens to an address
 - Receive ETH/tokens (display address, copy to clipboard, QR code)
@@ -1226,30 +1226,26 @@ indexes it as a real token transfer.
   address. Users should always verify the full address on the confirmation
   screen before signing or sending.
 
-- **Known token symbol verification**: AutistMask ships a hardcoded list of
+- **Known token symbol verification**: AutistMask ships a hardcoded list of the
-  high-market-cap ERC-20 tokens with their legitimate contract addresses and
+  top 250 ERC-20 tokens with their legitimate contract addresses and symbols.
-  symbols. The list is a point-in-time snapshot of the highest-market-cap
+  Any token transfer claiming a symbol from this list (e.g. "ETH", "USDT",
-  Ethereum mainnet ERC-20s taken from the CoinGecko API, with decimals verified
+  "USDC") but originating from an unrecognized contract address is identified as
-  on-chain and addresses EIP-55 checksummed; `TOKENS` in
+  a spoof and filtered from display. The fake "Ethereum" token in the attack
-  `src/shared/tokenList.js` is the authoritative set. It is bundled at build
+  above used symbol "ETH" from contract
-  time and only changes when that file is regenerated. Any token transfer
+  `0xD05339f9Ea5ab9d9F03B9d57F671d2abD1F55c82`, which does not match the known
-  claiming a symbol from this list (e.g. "ETH", "USDT", "USDC") but originating
+  WETH contract — so it would be caught by this check. Detecting a spoof is also
-  from an unrecognized contract address is identified as a spoof and filtered
+  what adds a contract to the fraud contract blocklist below; that is the only
-  from display. The fake "Ethereum" token in the attack above used symbol "ETH"
+  thing that populates it. In the transaction history the check is the "Hide
-  from contract `0xD05339f9Ea5ab9d9F03B9d57F671d2abD1F55c82`, which does not
+  fake tokens impersonating a known symbol" setting, on by default; with it off,
-  match the known WETH contract — so it would be caught by this check. Detecting
+  spoofed transfers are shown and no new blocklist entries are learned from
-  a spoof is also what adds a contract to the fraud contract blocklist below;
+  them. The send-screen token selector applies the same check unconditionally,
-  that is the only thing that populates it. In the transaction history the check
+  because it decides which tokens the user can act on rather than what the
-  is the "Hide fake tokens impersonating a known symbol" setting, on by default;
+  history displays. The balance list applies it unconditionally too, but not
-  with it off, spoofed transfers are shown and no new blocklist entries are
+  identically: it exempts symbols that `KNOWN_SYMBOLS` maps to `null`, and
-  learned from them. The send-screen token selector applies the same check
+  `"ETH"` is the only one. So the fake "Ethereum" token above is filtered from
-  unconditionally, because it decides which tokens the user can act on rather
+  the transaction history and from the send selector, but a fake-`ETH` ERC-20
-  than what the history displays. The balance list applies it unconditionally
+  that clears the balance list's own 1,000-holder floor — or that the user
-  too, but not identically: it exempts symbols that `KNOWN_SYMBOLS` maps to
+  tracked manually — is still shown in the balance list.
-  `null`, and `"ETH"` is the only one. So the fake "Ethereum" token above is
-  filtered from the transaction history and from the send selector, but a
-  fake-`ETH` ERC-20 that clears the balance list's own 1,000-holder floor — or
-  that the user tracked manually — is still shown in the balance list.
 
 - **Low-holder token filtering**: Token transfers from ERC-20 contracts with
   fewer than 1,000 holders are hidden from transaction history by default.

TODO.md

@@ -44,13 +44,6 @@ undefined identifiers, which is how
 
 # Completed Steps
 
-- 2026-08-12: Bundled token list documentation no longer states a count. The
-  four "top 250" claims in `README.md` and the "roughly 500" claim in
-  `docs/README.md` are replaced with a description of how the list is actually
-  selected — a point-in-time CoinGecko snapshot of the highest-market-cap
-  Ethereum mainnet ERC-20s — with `TOKENS` in `src/shared/tokenList.js` named as
-  the authoritative set
-  ([#239](https://git.eeqj.de/sneak/AutistMask/issues/239)).
 - 2026-08-11: libsodium runs on WebAssembly in the shipped builds —
   `'wasm-unsafe-eval'` added to both manifest CSPs after measuring the wasm2js
   fallback at 20x the Argon2id cost, pinned in both directions by

docs/README.md

@@ -327,19 +327,17 @@ individually removed to reset their permissions.
 AutistMask includes several defenses against common Ethereum scams, all enabled
 by default:
 
-**Known token symbol verification.** AutistMask ships a bundled list of
+**Known token symbol verification.** AutistMask ships a list of roughly 500
-high-market-cap ERC-20 tokens with their legitimate contract addresses — a
+legitimate ERC-20 tokens with their contract addresses. If a transaction or
-point-in-time snapshot of the highest-market-cap Ethereum mainnet ERC-20s, fixed
+balance claims to involve a known symbol (like "ETH" or "USDT") but comes from
-at build time and updated only when a new release ships a newer snapshot. If a
+an unrecognized contract, it is identified as a spoof and hidden. In your
-transaction or balance claims to involve a known symbol (like "ETH" or "USDT")
+transaction history this is the "Hide fake tokens impersonating a known symbol"
-but comes from an unrecognized contract, it is identified as a spoof and hidden.
+setting, which you can switch off; doing so also stops new entries being added
-In your transaction history this is the "Hide fake tokens impersonating a known
+to the fraud contract blocklist below, since detecting a spoof is what fills it.
-symbol" setting, which you can switch off; doing so also stops new entries being
+The send token list always applies the check. Your balances apply it too, with
-added to the fraud contract blocklist below, since detecting a spoof is what
+one exception: a token claiming the symbol "ETH" is not filtered there, so a
-fills it. The send token list always applies the check. Your balances apply it
+fake "ETH" token can still show up in your balance list even though it is hidden
-too, with one exception: a token claiming the symbol "ETH" is not filtered
+from your transaction history and from the send token list.
-there, so a fake "ETH" token can still show up in your balance list even though
-it is hidden from your transaction history and from the send token list.
 
 **Low-holder token filtering.** Tokens with fewer than 1,000 holders are hidden
 from transaction history and the send token list, and are left out of your