feat: import explorer-verified tokens into the pair list

[erubboli]

Verified-token mass import

Imports the Mintlayer explorer's verified token list into Token
Management so every approved token becomes tradeable without manual ID
entry. Imports land in the same favourites store that drives the Trading
pair selector, so imported tokens appear there on next load.

• GET /api/explorer-tokens (new): server-side proxy for the
  explorer token API. Fixed hosts only (staging explorer for
  mainnet/testnet, optional EXPLORER_TOKENS_API_BASE override), both
  supply filters merged, verified === true rows kept, streamed 2 MiB
  body cap, JSON content-type enforcement, 12 s timeout, in-memory cache
  with stampede dedupe (respects the explorer's ≤1 req/10 s etiquette).
  No explorer-controlled string reaches the DOM unescaped or oversized.
• Import UI (TokenSearch): "Browse verified tokens" — preview with
  select-all, per-row checkboxes, already-listed badge, and an
  "Import selected (N)" action merging into favourites (cap 500).
• Batched resolution (token-info-client.ts): node_get_tokens_info
  is now called in 50-id chunks aligned by each result's own
  content.token_id — hundreds of imported tokens cost a couple of RPCs
  instead of one per token (Token Management + Order Book both use it).
• POST /api/prefs hardening: entry validation (tokenId ≤128,
  ticker ≤32, legacy strings tolerated), 1000-entry cap, 1 MiB body
  pre-check; GET re-validates stored rows on read.

Security review pass applied: streamed body cap instead of full-buffer,
persist-before-commit favourite toggles (no stale overwrites), host
disclosure removed from the route response.

Gates: tsc clean, 876 tests green, production build OK.