RULES.md: state every action that asks for the password (closes #756)

Replace the Secrets & Storage line "Password only required for signing
operations" with the wording sneak approved: the password is required for
signing, deleting a wallet, and showing a recovery phrase or private key.

Model: opus-5-5

RULES.md

@@ -22,12 +22,10 @@ contradicts either, the originals govern.
 
 ## External Communication
 
-- [ ] Until the user changes a setting, the extension contacts only the
+- [ ] Extension contacts exactly three external services: configured RPC
-      configured RPC endpoint
+      endpoint, CoinDesk price API, and Blockscout block-explorer API
 - [ ] No analytics, telemetry, or tracking
-- [ ] No user-specific data sent except to the configured RPC endpoint, unless
+- [ ] No user-specific data sent except to the configured RPC endpoint
-      the user turns on "Use Blockscout" or "Check recipients on Etherscan",
-      both off by default
 - [ ] No Infura/Alchemy hard dependency
 - [ ] No backend servers operated by the developer
 - [ ] RPC endpoint is user-configurable (defaults to publicnode.com)
@@ -101,7 +99,8 @@ contradicts either, the originals govern.
 
 - [ ] Public data (xpubs, addresses, balances) stored unencrypted
 - [ ] Private data (recovery phrases, private keys) encrypted at rest
-- [ ] Password only required for signing operations
+- [ ] Password required for signing, deleting a wallet, and showing a recovery
+      phrase or private key
 - [ ] No secrets in `.env`, credentials, or API keys committed to repo
 - [ ] `git add -A` / `git add .` never used