Fix the IDM Inbox app in this repository (built by swarm job 936d49d1-4552-436a-91f2-9348bdfe9d8a). That job's objective and step specs, readable at https://api.imd.fun/jobs/936d49d1-4552-436a-91f2-9348bdfe9d8a, remain the product spec, and every rule in them still applies. If that URL is unreachable, the repo's code and README plus this brief are the spec. Change no behaviour except what this brief names; the only new behaviours are B6's arrow-key tabs, B8's wallet picker and the loading state in A2. This job fixes bugs found by a browser review of commit 3f2a2a31 and adds the tests that were missing.

WHY THE BUGS SLIPPED: Node/jsdom tests passed while the app failed in real browsers. Example: calling a stored fetch as a method (this.fetcher(url)) throws "Illegal invocation" in Chromium but not in Node. Write tests that model browser behaviour where it matters (see step A).

GLOBAL RULES

• Keep every existing passing test passing unless a rule below changes the behaviour; update those tests.
• Pin vitest to 3.2.7 (3.0.5 is blocked as a critical CVE); regenerate package-lock.json.
• Move vite, typescript and @vitejs/plugin-react to devDependencies.
• No fixtures/ import from non-test code in src/. The live app must read live data only; fixtures are for tests.
• Keep src/config.ts as the only place for addresses and hosts.
• Keep the CSP meta tag the first child of , and the tip presets and order unchanged. Keep all UI strings unchanged except the new strings this brief quotes.
• The existing home test must feed fixtures/dev-board.json through a mocked fetch. Never re-import fixtures in app code.
• Add prettier 3.6.2 (pinned) as a devDependency and a format:check script (prettier --check src) that runs inside ci. Format src/ with printWidth 100. No multi-statement one-liners.
• npm ci && npm run ci must pass. Rebuild dist/.