docs: the sentences the rewrite reviews left as follow-up notes (closes #723)

Each sentence named on #723 now
matches the code on `next`:

- the Firefox load steps are numbered;
- the AddToken refusal lists name a token that fakes a known symbol;
- the worker's in-memory state is listed in full;
- `script/bootstrap` falls back to `npm install -g` for yarn;
- the Send line under a `null` ETH balance holds with ETH selected, and
  "Max" has a line of its own;
- the Home and Send lines there name `SepoliaETH` on Sepolia;
- the well-known symbols are given per network;
- a network switch empties the fraud contract list;
- the cases where an import leaves out a removed address are spelled out;
- a new token's line depends on "Show tracked tokens with zero balance";
- wallet drainer is defined at first use only.

Model: fable-5-1

README.md

@@ -1238,8 +1238,9 @@ is `null`:
 - Home's ETH balance reads `unknown (ETH)` on mainnet and `unknown (SepoliaETH)`
   on Sepolia;
 - with ETH selected, Send reads `Current balance: unknown (ETH)` on mainnet and
-  `Current balance: unknown (SepoliaETH)` on Sepolia, and "Max" fills in nothing
-  and shows the flash message "This token's balance is unknown.";
+  `Current balance: unknown (SepoliaETH)` on Sepolia;
+- with ETH selected, "Max" fills in nothing and shows the flash message "This
+  token's balance is unknown.";
 - "Send" is not refused for a zero balance;
 - the address has no total;
 - DeleteAddress shows its warning.

docs/README.md

@@ -212,15 +212,18 @@ allowed or denied for it.
 
 Getting the address back is not easy. "+" computes only addresses that this
 wallet has never listed. The removed address was listed once, so "+" skips it.
-The way back is to delete the whole wallet and import its backup again. After
-the import, the scan lists the address again when it holds ETH or has sent a
-transaction. The scan misses such an address in two cases:
+The way back is to delete the whole wallet and import its backup again. The
+import lists the wallet's first address, then scans for used addresses. An
+address is used when it holds ETH or has sent a transaction. A read that fails
+during the scan counts the address as unused. The scan stops after five unused
+addresses in a row. When the scan finds two or more used addresses, the wallet
+lists those instead. The wallet does not list the removed address when:
 
-- the address lies past five unused addresses in a row;
-- the address is the only used one the scan finds.
+- the scan finds two or more used addresses, and the address is not among them;
+- the scan finds fewer than two, and the address is not the first.
 
-When the scan does not list the address, "+" may reach it again, because the new
-wallet has never listed it.
+When the wallet does not list the address, "+" may reach it again, because the
+new wallet has never listed it.
 
 ### Deleting a wallet
 
@@ -626,11 +629,10 @@ threshold starts at 100,000 gwei, which is 0.0001 ETH. A threshold of 0 hides
 nothing.
 
 Known scam addresses. The wallet ships a list of addresses known for fraud,
-including phishing addresses and wallet drainers. A wallet drainer is a contract
-that empties a wallet once given permission. Sending to a listed address raises
-a warning on the confirmation screen, and a listed address cannot be tracked as
-a token. The list holds only addresses involved in fraud; it is not a sanctions
-list.
+including phishing addresses and wallet drainers. Sending to a listed address
+raises a warning on the confirmation screen, and a listed address cannot be
+tracked as a token. The list holds only addresses involved in fraud; it is not a
+sanctions list.
 
 Addresses and hashes are shown in full, because address poisoning relies on
 shortened ones. The only shortened address is the label of a token with no known