docs: the sentences the rewrite reviews left as follow-up notes (closes #723)

Each sentence named on #723 now
matches the code on `next`:

- the Firefox load steps are numbered;
- the AddToken refusal lists name a token that fakes a known symbol;
- the worker's in-memory state is listed in full;
- `script/bootstrap` falls back to `npm install -g` for yarn;
- the Send line under a `null` ETH balance holds with ETH selected;
- the Home and Send lines there name `SepoliaETH` on Sepolia, and the flash
  message "Max" shows;
- the well-known symbols are given per network;
- a network switch empties the fraud contract list;
- the address scan's two misses are listed;
- a new token's line depends on "Show tracked tokens with zero balance";
- wallet drainer is defined at first use.

Model: fable-5-1

README.md

@@ -1238,9 +1238,8 @@ is `null`:
 - Home's ETH balance reads `unknown (ETH)` on mainnet and `unknown (SepoliaETH)`
   on Sepolia;
 - with ETH selected, Send reads `Current balance: unknown (ETH)` on mainnet and
-  `Current balance: unknown (SepoliaETH)` on Sepolia;
-- with ETH selected, "Max" fills in nothing and shows the flash message "This
-  token's balance is unknown.";
+  `Current balance: unknown (SepoliaETH)` on Sepolia, and "Max" fills in nothing
+  and shows the flash message "This token's balance is unknown.";
 - "Send" is not refused for a zero balance;
 - the address has no total;
 - DeleteAddress shows its warning.

docs/README.md

@@ -212,18 +212,15 @@ allowed or denied for it.
 
 Getting the address back is not easy. "+" computes only addresses that this
 wallet has never listed. The removed address was listed once, so "+" skips it.
-The way back is to delete the whole wallet and import its backup again. The
-import lists the wallet's first address, then scans for used addresses. An
-address is used when it holds ETH or has sent a transaction. A read that fails
-during the scan counts the address as unused. The scan stops after five unused
-addresses in a row. When the scan finds two or more used addresses, the wallet
-lists those instead. The wallet does not list the removed address when:
+The way back is to delete the whole wallet and import its backup again. After
+the import, the scan lists the address again when it holds ETH or has sent a
+transaction. The scan misses such an address in two cases:
 
-- the scan finds two or more used addresses, and the address is not among them;
-- the scan finds fewer than two, and the address is not the first.
+- the address lies past five unused addresses in a row;
+- the address is the only used one the scan finds.
 
-When the wallet does not list the address, "+" may reach it again, because the
-new wallet has never listed it.
+When the scan does not list the address, "+" may reach it again, because the new
+wallet has never listed it.
 
 ### Deleting a wallet
 
@@ -629,10 +626,11 @@ threshold starts at 100,000 gwei, which is 0.0001 ETH. A threshold of 0 hides
 nothing.
 
 Known scam addresses. The wallet ships a list of addresses known for fraud,
-including phishing addresses and wallet drainers. Sending to a listed address
-raises a warning on the confirmation screen, and a listed address cannot be
-tracked as a token. The list holds only addresses involved in fraud; it is not a
-sanctions list.
+including phishing addresses and wallet drainers. A wallet drainer is a contract
+that empties a wallet once given permission. Sending to a listed address raises
+a warning on the confirmation screen, and a listed address cannot be tracked as
+a token. The list holds only addresses involved in fraud; it is not a sanctions
+list.
 
 Addresses and hashes are shown in full, because address poisoning relies on
 shortened ones. The only shortened address is the label of a token with no known