fix: read USD prices from Chainlink price feeds through the RPC endpoint (closes #525)

CoinDesk now refuses every request without an API key, so mainnet showed no
USD prices. On mainnet the wallet now reads latestRoundData() from Chainlink's
USD price feeds through the configured RPC endpoint. ETH and the held or
tracked tokens with a feed are read as one batched request, at most every 5
minutes. src/shared/tokenList.js lists the feeds of 53 bundled tokens, keyed by
contract address, and the ETH/USD feed. A reading older than its feed's
heartbeat plus 30 minutes, or not positive, is no price. A failed read leaves
no price and is logged. getPrice() takes a contract address instead of a
symbol. The CoinDesk request is removed.

Model: opus-5-5

README.md

@@ -2821,9 +2821,6 @@ view would leave a wallet one click from deletion.
     - "Export Saved Data" button, and the read-only text box it fills
     - What erasing does and does not do, in bold: every wallet stored in this
       browser is deleted; nothing on chain changes and no money is moved
-    - What a wallet can be added again from: a kept copy of its recovery phrase,
-      private key or extended private key. Without that copy or the exported
-      copy, everything the wallet holds is gone forever.
     - A text input asking for `ERASE MY WALLET` to be typed back
     - Error line
     - "Erase Saved Data" button

src/popup/index.html

@@ -1994,11 +1994,10 @@
                         >Erasing the saved data deletes every wallet stored in
                         this browser.</strong
                     >
-                    Nothing on the blockchain changes and no money is moved. If
-                    you kept a copy of a wallet's recovery phrase, private key
-                    or extended private key, you can add that wallet again.
-                    Without that copy or the exported copy above, everything the
-                    wallet holds is gone forever.
+                    Nothing on the blockchain changes and no money is moved, but
+                    without the exported copy above, or the recovery phrase for
+                    each wallet written down, everything they hold is gone
+                    forever.
                 </p>
                 <p class="text-xs mb-1">
                     To confirm, type

tests/stateRecovery.test.js

@@ -23,9 +23,6 @@
 // version field, and showing those users a wipe prompt would be a worse defect
 // than the one being fixed. It is migrated in place and keeps working.
 
-const fs = require("fs");
-const path = require("path");
-
 const {
     bootPopup,
     cleanupPopup,
@@ -151,29 +148,6 @@ describe("the destructive reset on the recovery screen", () => {
     });
 });
 
-// A key or xprv wallet has no recovery phrase, so the erase warning names all
-// three backups (https://git.eeqj.de/sneak/AutistMask/issues/593). The boot
-// harness holds no static text, so this reads the markup itself.
-describe("the erase warning on the recovery screen", () => {
-    test("names the recovery phrase, the private key and the extended private key", () => {
-        const html = fs.readFileSync(
-            path.join(__dirname, "..", "src", "popup", "index.html"),
-            "utf8",
-        );
-        const start = html.indexOf('id="view-state-recovery"');
-        const end = html.indexOf('id="btn-state-recovery-reset"', start);
-        const screenText = html
-            .slice(start, end)
-            .replace(/<[^>]*>/g, " ")
-            .replace(/\s+/g, " ");
-
-        expect(screenText).toContain(
-            "If you kept a copy of a wallet's recovery phrase, private key or " +
-                "extended private key, you can add that wallet again.",
-        );
-    });
-});
-
 describe("a popup already open when the stored profile becomes unreadable", () => {
     // https://git.eeqj.de/sneak/AutistMask/issues/373. The popup used to stay
     // on the wallet list with the last good balances, and only a reopen