fix: Blockscout and Etherscan lookups are off until the user turns them on (closes #668)

Out of the box the wallet sent the user's addresses to Blockscout and each
recipient to Etherscan. Two settings, "Use Blockscout" and "Check recipients on
Etherscan", now gate those requests. Both are off in a new install and offered
unticked on Welcome and in Settings. While one is off, the screens that relied
on it say so in a plain line. Each gated request reads its setting from storage
before it asks and when the answer lands, and drops a late answer. An open popup
takes another page's change and draws its screens again. While "Use Blockscout"
is off, no address keeps an untracked token, and no screen names a token from
Blockscout's report. ENS lookups ask only the RPC endpoint.

Model: opus-5-5 (implementation); fable-5-1 (prose)

README.md

@@ -439,8 +439,9 @@ It also covers what a new install sends to Blockscout and Etherscan
 ([#668](https://git.eeqj.de/sneak/AutistMask/issues/668)). The harness installs
 a route handler before the first popup page opens. From then on, the handler
 records every request the extension makes, from its pages and from its
-background worker. The background worker starts earlier, but it makes no request
-while it starts up. The tests take these steps in order:
+background worker. The background worker also makes requests while it starts up.
+Those come before the handler is installed, so they are not recorded. The tests
+take these steps in order:
 
 - Welcome must offer "Use Blockscout" and "Check recipients on Etherscan"
   unticked.
@@ -1225,7 +1226,7 @@ refusal the wallet has any reason to make.
 While "Use Blockscout" is on, the Send screen also consults every address's
 explorer reports. The reports for two addresses may give different `decimals`
 for one contract. That token then has no scale on Send. Its stored balance is
-not shown either. The Send screen's `Current balance` and the confirmation
+withdrawn as well. The Send screen's `Current balance` and the confirmation
 screen's balance line then both read `unknown (SYMBOL)`. The balance list
 formats each explorer row as it is fetched, without that cross-address check,
 and shows the row's figure.
@@ -1707,9 +1708,9 @@ view would leave a wallet one click from deletion.
   screen in that case.
 - **Elements**:
     - "Welcome! To get started, add a wallet." text
-    - A well opening with "This wallet sends your data only to the Ethereum RPC
-      endpoint, unless you turn on one of these. You can change them later in
-      Settings."
+    - A well. Its first line says that the wallet sends the user's data only to
+      the Ethereum RPC endpoint unless one of the two checkboxes below is
+      ticked, and that both can be changed later in Settings
     - In the well, the "Use Blockscout" and "Check recipients on Etherscan"
       checkboxes, the same two as in Settings. Under each, a sentence says what
       the setting sends and to which service. Both are unticked until the user
@@ -2072,8 +2073,8 @@ view would leave a wallet one click from deletion.
       `Unknown (could not be decoded)` with no symbol, not the transaction's ETH
       value. When that swap's `Token In` is `ETH (native)`, the transaction's
       ETH value in the network's currency, as for any other transaction
-    - A line under the amount, worded as on TxApproval. While "Use Blockscout"
-      is off, the line shows when the bundled list and the tracked tokens lack
+    - A line under the amount, worded as on TxApproval. The line shows while
+      "Use Blockscout" is off and the bundled list and the tracked tokens lack
       the token's name or decimals.
     - To: color dot + full address + etherscan link; for a contract creation,
       which has no recipient, "This transaction creates a new contract. It has
@@ -2608,7 +2609,7 @@ view would leave a wallet one click from deletion.
       unknown (see Transaction Decoding)
     - A line under each token of the decoded action: "Blockscout's report of
       your balances is not used to name this token, because "Use Blockscout" is
-      off in Settings." While "Use Blockscout" is off, the line shows when the
+      off in Settings." The line shows while "Use Blockscout" is off and the
       bundled list and the tracked tokens lack the token's name or decimals.
       While the setting is on, Blockscout's report of the user's balances is a
       third source of a token's name and decimals (see Unknown token scale).

tests/e2e/run.js

@@ -280,8 +280,9 @@ test("the exact confirmation phrase erases the record and reloads into Welcome (
 // The route handler in tests/e2e/network.js records in env.routeOpts.requests
 // every request the extension makes, from its pages and its background worker.
 // Recording starts when launch() in tests/e2e/harness.js installs that handler,
-// before the first popup page opens. The background worker starts earlier, but
-// it makes no request while it starts up.
+// before the first popup page opens. The background worker also makes requests
+// while it starts up. Those come before the handler is installed, so they are
+// not recorded.
 //
 // Before either setting is changed, these tests drive:
 //