Connect to the real Nexa backend, replacing the mock lock toggle

Adds the wire-protocol WebSocket client (ws-client.ts) and the REST
auth flow (backend-client.ts) against the now-live backend, using a
locally-generated ed25519 keypair (identity.ts) as a stand-in wallet
signer until real wallet-extension integration is built.

lock-state.ts's setLockState is now applyLockState, called only by
the WS client on an incoming lock_state message -- the backend is
the sole source of truth for lock state, so there's no other writer
anymore. The popup's dev mock controls are replaced with a live
connection-status + lock-state display.

Verified end-to-end against the real backend (nonce -> verify -> /me
-> ws lock_state) using the same tweetnacl/bs58 libs shipped in the
extension.

Co-Authored-By: Claude Sonnet 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01YXiHuScXrjxBh7yFGAPq3B

src/shared/config.ts

@@ -0,0 +1,8 @@
+/**
+ * Nexa backend location. Dev-only default — swap for the real deployed
+ * backend host before shipping (see backend/CLAUDE.md, "Relationship to the
+ * frontend"). `host_permissions` in wxt.config.ts must be kept in sync with
+ * this host.
+ */
+export const BACKEND_HTTP_URL = 'http://localhost:3000';
+export const BACKEND_WS_URL = 'ws://localhost:3000/ws';