feat(extension): thread chainId through threat API lookups (S-16)

[Lykhoyda]

Summary

Unblocks the testudo-api deploy. API PR #5 moves client-facing threat routes under /api/v1/chains/:chainId/... — without this change, deploying produces 404s on every threat lookup. Ship order: this lands in Chrome Web Store before the API rolls out.

What changed

api-client.ts

• ApiClientOptions.chainId?: number
• checkAddressThreat() + pingApi() build URLs as /api/v1/chains/${chainId}/threats/address/...
• resolveChainId() falls back to 1 for missing / non-finite / non-positive input (matches api-server behavior; keeps cold-start protection alive)
• ThreatResponse exposes optional matchedChainId + crossChainMatch (reserved for future cross-chain UX)
• checkDomainThreat() unchanged — domain route stays global

analysis.ts

• AnalysisDeps.checkAddressThreat accepts {chainId?}
• analyzeWithCache() / addressCheckWithCache() accept optional chainId
• Cache key is now ${chainId}:${address} — same address on different chains caches independently. pendingFullAnalysis / pendingAddressCheck use the same key for request coalescing

injected.tsx

• Lazy getCurrentChainId() via eth_chainId RPC; cached, invalidated on wallet's chainChanged event
• parseChainIdHex() accepts number or 0x-hex; rejects 0 / NaN / invalid
• Permit + typed-data flows prefer the typed domain's chainId, fall back to active chain
• EIP-7702 uses the auth's chainId; when that is 0 (replay risk) the threat lookup falls back to the active chain so we key into a real chain's registry instead of a sentinel

Message bridge

• content.ts, services/messaging.ts, background.ts forward chainId end-to-end. Handlers coerce non-number inputs to undefined so the api-client default applies at the URL boundary

Tests — 375 pass (9 new)

api-client.test.ts

• URL has chains segment
• Custom chainId routed to correct path
• Default to chainId=1 on missing / 0 / -1 / NaN
• pingApi routing + default

analysis.test.ts

• chainId forwarded to checkAddressThreat (address-only + full pipeline)
• Per-chain cache partitioning
• Default cache key uses chain 1
• Cross-chain cache isolation

Test plan

• yarn workspace @testudo/extension run test — 375 pass
• yarn workspace @testudo/extension run build — clean (injected.js 83.2 KB)
• yarn biome check packages/extension/src packages/extension/tests — clean
• E2E on CI (happens on PR open)
• Manual QA: switch chains in wallet, trigger an approval — confirm URL includes new chain id (via devtools / API logs)

Ship sequence

1. Merge this PR
2. Submit extension to Chrome Web Store (24–72h review)
3. After extension rollout in production, deploy testudo-api PR fix(core+injected): replay-risk typed confirm + core stability hardening #5

🤖 Generated with Claude Code