[State Sync Redesign 3.3b] Remove flat state from `createEip1193MethodMiddleware`

`setupUntrustedCommunicationEip1193` passes `metamaskState: this.getState()` as a one-time flat state snapshot to `createEip1193MethodMiddleware`. With `getState()` now returning controller-keyed state, the middleware receives a different shape.

The middleware should read from controllers directly or accept keyed state.

## Steps

1. Identify which properties `createEip1193MethodMiddleware` reads from `metamaskState`
2. Replace the one-time snapshot with direct controller reads (e.g., pass controller accessors or messenger) or accept keyed state
3. Remove the `metamaskState` parameter from the middleware options

## Files

- `app/scripts/metamask-controller.js` (call site)
- `app/scripts/lib/rpc-method-middleware/createEip1193MethodMiddleware.ts` (consumer)

## Risk

Low — one-time snapshot used during stream setup, not reactive.

## Dependencies

Issue 3.3 (simplify `getState()` to controller-keyed)

## Context

Part of [State Sync Redesign — Epic 3: Background cleanup]. Gap identified during PoC branch `jongsun/poc/sync-state-redesign`.

Start at the call site in app/scripts/metamask-controller.js and trace the metamaskState option into app/scripts/lib/rpc-method-middleware/createEip1193MethodMiddleware.ts. Identify the properties read from the snapshot, then remove the middleware option by using direct controller access or keyed state, with setupUntrustedCommunicationEip1193 still able to establish the stream.

Written by the indexing model from the issue text.