fix: harden popup lifecycle against hangs and duplicates

[BitHighlander]

Summary

Fixes three recurring popup bugs:

1. Hangs open forever after a signing flow completes.
2. Opens multiple windows for a single pending request.
3. Approval promise never resolves when the user X's the popup (dapp's RPC call hangs until its own timeout).

Root causes

Hang: Chain handlers broadcast `signature_complete` / `transaction_complete` without any event identifier. The popup's `Transaction.tsx` closes the window on ANY such message — including messages destined for a different queued request — while the corresponding `requireApproval()` promise keeps waiting for the original response.

Duplicates: `methods.ts` tracks "popup open" with an in-memory flag. In MV3 the service worker is torn down frequently, so the flag resets to `false` while the popup window is still visible; the next request opens a second window. A parallel, unused `openPopup` in `ethereumHandler.ts` had no dedup at all.

X → hang: `requireApproval()` only resolves when an `eth_sign_response` message arrives. Closing the popup sent no such message, so the promise never settled; the background handler stayed awaiting and the dapp's RPC call blocked until its own timeout.

Changes

`chrome-extension/src/background/methods.ts`

• Replace the `isPopupOpen` flag with an async check via `chrome.windows.getAll({windowTypes:['popup']})` matched by URL. Survives service worker restarts — no more second windows after a wake-up.
• Register `chrome.windows.onRemoved` exactly once at module load and fan out to per-request subscribers. Previously a new listener was added on every `openPopup` call and leaked.
• `requireApproval()` now subscribes to the popup-close stream and resolves `{success:false}` if the window closes before an approval response arrives.

All chain handlers (`ethereum`, `solana`, `bitcoin`, `bitcoincash`, `dogecoin`, `litecoin`, `dash`, `thorchain`, `cosmos`, `osmosis`, `maya`, `ripple`)

• Every `transaction_complete` / `signature_complete` / `transaction_error` payload now carries `eventId`.
• Ethereum threads the event id through `processApprovedEvent` → `signMessage` / `signTypedData`.
• Solana's `buildEvent` now mutates `requestInfo.id` so it's the same id everywhere (it was previously possible for the event to be stored under a fresh UUID that `requireApproval` never saw).

`pages/popup/src/components/Transaction.tsx`

• Early-returns from `handleMessage` if the incoming `eventId` doesn't match the current event. Unscoped legacy messages still flow through for backward compatibility.

`chrome-extension/src/background/chains/ethereumHandler.ts`

• Deletes the dead `openPopup` / `requireUnlock` pair (not called anywhere) that lacked dedup and would have been a future foot-gun.

Test plan

• Single sign: `eth_signTypedData_v4` → popup opens → approve → popup closes, no hang in background.
• User cancel: open popup, close the window with the X → dapp receives "User denied" promptly (no hang).
• Duplicate protection: rapid-fire two requests → single popup (focused), not two windows.
• Service worker wake: use the extension, leave it idle until SW terminates, fire a request → still single popup.
• Solana `signMessage` + `signTransaction` + `signAndSendTransaction` complete as expected.
• UTXO chain (BTC/LTC/DOGE/DASH/BCH) transfer completes, TxidPage shows hash.
• Cosmos-family (THOR/Maya/Osmosis/Cosmos) + XRP transfers complete.
• Existing installs still close the popup on legacy messages that don't carry an `eventId`.

🤖 Generated with Claude Code