Connect to the real Nexa backend, replacing the mock lock toggle

Adds the wire-protocol WebSocket client (ws-client.ts) and the REST
auth flow (backend-client.ts) against the now-live backend, using a
locally-generated ed25519 keypair (identity.ts) as a stand-in wallet
signer until real wallet-extension integration is built.

lock-state.ts's setLockState is now applyLockState, called only by
the WS client on an incoming lock_state message -- the backend is
the sole source of truth for lock state, so there's no other writer
anymore. The popup's dev mock controls are replaced with a live
connection-status + lock-state display.

Verified end-to-end against the real backend (nonce -> verify -> /me
-> ws lock_state) using the same tweetnacl/bs58 libs shipped in the
extension.

Co-Authored-By: Claude Sonnet 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01YXiHuScXrjxBh7yFGAPq3B

wxt.config.ts

@@ -9,7 +9,9 @@ export default defineConfig({
     name: 'Nexa',
     description: 'Your blockchain powered agent to help with your trading emotions.',
     permissions: ['storage'],
-    host_permissions: ['https://axiom.trade/*'],
+    // axiom.trade: the site adapter target. localhost:3000: the Nexa backend
+    // (dev only — swap/extend for the real backend host before shipping).
+    host_permissions: ['https://axiom.trade/*', 'http://localhost:3000/*'],
     browser_specific_settings: {
       gecko: {
         // Placeholder id for local/dev builds; replace before publishing to AMO.