Parse MPMA CSV with the module written for it

[droplister]

Stacked on #247. Wires up the two validators #246 deliberately left undeleted — and finds that one of them must not go where I first said.

csv.ts → MPMA parsing

The form parsed CSV with line.match(/(".*?"|[^,]+)(?=\s*,|\s*$)/g) over text.split('\n'). parseCSV replaces that and adds what the loop never had:

• formula-injection rejection — a row containing =cmd|calc was accepted before
• a row cap (10,000)
• real quoted-field parsing

Address checking is left off (validateAddresses: false) so the form's existing validateBitcoinAddress — which verifies the checksum — keeps running instead of the module's format-only test. The divisibility lookup and memo-length check are untouched.

One message changed. An unparseable quantity now reads "Quantity must be a number" rather than "Invalid quantity" — it says why rather than only that. The test asserting the old wording is updated.

file.ts → the CSV upload, not the inscription upload

The CSV upload had no size limit at all — only file.name.endsWith('.csv'), then the whole file was read into memory regardless of size. validateFile now bounds it at 2 MB and owns the extension check.

detectMaliciousPatterns is deliberately off: parseCSV already screens every field for injection, which covers the whole file rather than the first kilobyte, and a script-marker scan could trip on a legitimate memo.

Why file.ts is not wired into inscriptions

I said earlier that file-upload-input.tsx "validates nothing" and the inscription path was a gap. Checking the module changed that conclusion.

detectMaliciousContent rejects any text/* file containing <script, <iframe or javascript:. An HTML inscription carrying a script tag is exactly what that feature publishes — wiring this in would have broken inscriptions, which only started working in 0.7.0. Its type and extension checks are wrong there for the same reason: an inscription is arbitrary content by definition.

The size-only check those forms do is correct. file.ts was written for uploads that should be constrained; inscriptions aren't.

Tests

Two new cases covering exactly what the change buys:

• a row carrying =cmd|calc is rejected
• a quoted memo containing a comma survives as one field rather than splitting into a fourth column

Verification

• tsc --noEmit clean; biome check src clean (672 files)
• vitest run src — 3965 passed, 49 skipped
• wxt build succeeds
• playwright test e2e/pages/compose/send/mpma.spec.ts — 6 passed

[droplister]

Squashed into #249.