You approved it once. It never expired. Here's how attackers drain wallets through forgotten permissions — and how to fix it in 15 minutes.