Connect to the real Nexa backend, replacing the mock lock toggle

Adds the wire-protocol WebSocket client (ws-client.ts) and the REST
auth flow (backend-client.ts) against the now-live backend, using a
locally-generated ed25519 keypair (identity.ts) as a stand-in wallet
signer until real wallet-extension integration is built.

lock-state.ts's setLockState is now applyLockState, called only by
the WS client on an incoming lock_state message -- the backend is
the sole source of truth for lock state, so there's no other writer
anymore. The popup's dev mock controls are replaced with a live
connection-status + lock-state display.

Verified end-to-end against the real backend (nonce -> verify -> /me
-> ws lock_state) using the same tweetnacl/bs58 libs shipped in the
extension.

Co-Authored-By: Claude Sonnet 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01YXiHuScXrjxBh7yFGAPq3B

src/entrypoints/background.ts

@@ -1,16 +1,25 @@
-import { getLockState, setLockState } from '@/background/lock-state';
+import { getSessionToken } from '@/background/backend-client';
+import { getConnectionStatus, setConnectionStatus } from '@/background/connection-status';
+import { applyLockState, getLockState } from '@/background/lock-state';
+import { connectWsClient } from '@/background/ws-client';
 import type { NexaMessage } from '@/shared/messaging';
 
 export default defineBackground(() => {
+  connectWsClient({
+    getToken: getSessionToken,
+    onLockState: (state) => void applyLockState(state),
+    onStatusChange: (status) => void setConnectionStatus(status),
+  });
+
   browser.runtime.onMessage.addListener((message: NexaMessage, _sender, sendResponse) => {
     switch (message?.type) {
       case 'nexa:get-lock-state':
         getLockState().then(sendResponse);
         return true; // keep the message channel open for the async response
 
-      case 'nexa:set-lock-state':
-        setLockState(message.state).then(() => sendResponse({ ok: true }));
-        return true;
+      case 'nexa:get-connection-status':
+        sendResponse(getConnectionStatus());
+        return false;
 
       case 'nexa:open-popup':
         // Best-effort: not all browsers/contexts allow programmatic popup