[HIGH] Connect approval/confirm modals show unverified dApp-supplied identity, not the verified origin

Summary

At every human decision point the user sees dApp-self-reported metadata (dapp.name/url/icon in the approval modal; a message-parsed Domain: line in sign_message) instead of the cryptographically verified origin. In the popup ConnectPage flow the verified origin is known (searchParams 'origin', enforced by PostMessageTransport.allowedOrigins) but it is not forwarded to the modal — it shows only in a status bar behind the full-screen overlay. SendIntentModal shows no dApp identity at all. sign_message blind-signs arbitrary text with attacker-controlled provenance.

Where

src/components/connect/ConnectionApprovalModal.tsx:71, src/components/connect/ConnectIntentHandler.tsx:271 (sign), src/pages/ConnectPage.tsx:120/181.

Note (verified against installed SDK)

ConnectHost does not echo the verified origin into onConnectionRequest, but the app pins and therefore knows it (allowedOrigins). Fix is app-side. Optional SDK enhancement: echo the verified origin back into the callback for defense-in-depth.

Fix

Forward the transport-verified origin into requestApproval/PendingApproval and render it as the primary, non-overridable identity in every approval and value/sign confirm modal (MetaMask-style). Treat dapp.* as untrusted decoration. Adopt domain-bound structured signing instead of blind signMessage.

Found by multi-agent audit @ main b477d4d7; adversarially verified. Shares the "show verified origin" fix with the IframeAgent embed issue — do that one first, this reuses it.