docs: add S-16 API chainId sync plan (blocks testudo-api deploy)

[Lykhoyda]

Summary

Adds a new In Progress item to the roadmap: API chainId Sync (S-16 Client Update). This is the extension-side work required to match testudo-api PR #5 which moves client-facing routes under /api/v1/chains/:chainId/....

Deploying the API without shipping this update first would 404 every threat lookup in the field.

Context

testudo-api PR #5 (S-16 Consistent chainId Modeling) changes three extension-facing endpoints:

Before	After
GET /api/v1/threats/address/:address	GET /api/v1/chains/:chainId/threats/address/:address
GET /api/v1/safe/address/:address	GET /api/v1/chains/:chainId/safe/address/:address
POST /api/v1/encounters (chainId in body)	POST /api/v1/chains/:chainId/encounters (chainId in path)

The domain threat route stays global, so checkDomainThreat() is unaffected.

What this PR does

Documentation only — captures the plan, priority, scope, and design decision (mainnet default). No code changes.

Key design decision: when chainId isn't yet resolved from eth_chainId (cold-start pingApi, first-paint analysis before RPC responds), default to 1 (mainnet) rather than failing the request. Rationale documented in the roadmap entry.

Affected call sites (extension)

• packages/extension/src/api-client.ts — checkAddressThreat(), pingApi()
• packages/extension/src/analysis.ts — thread chainId through AnalysisDeps
• packages/extension/src/background.ts — extract chainId via eth_chainId with mainnet fallback
• packages/extension/src/injected.tsx — propagate chainId already extracted from EIP-7702 TypedData
• packages/extension/tests/api-client.test.ts + tests/analysis.test.ts — ~53 test cases to update

Ship sequence

1. Merge this roadmap PR to signal the commitment
2. Implement the client sync (separate PR)
3. Submit extension to Chrome Web Store (24–72h review)
4. Only then deploy testudo-api PR fix(core+injected): replay-risk typed confirm + core stability hardening #5

Relationship to existing roadmap

This is a hard prerequisite for 2.1 Multichain EVM Support — same chainId plumbing, narrower scope (API calls only, not RPC routing or Blockscout). 2.1 builds on top of this.

Test plan

• ROADMAP.md renders correctly (encrypted file, verified via size delta +2.4KB)
• Cross-reference in testudo-api repo ROADMAP updated (already landed on feat/s16-chainid-modeling: commit 9fa344f)

🤖 Generated with Claude Code