Skip re-signing when a session token already exists

A content script reports 'wallet-connected' on every page load (it
always tries a silent onlyIfTrusted connect first), and the handler
was unconditionally running the full nonce/sign/verify cycle every
time. signMessage() shows a fresh Phantom approval popup on every
call, unlike connect() which is silent once trusted -- so this meant
a new signature prompt on every single axiom.trade page load, caught
during manual testing ("signing appears every time").

Now the handler checks for an existing valid session token first and
only re-authenticates when there isn't one.

Confirmed end-to-end against real Phantom on Zen: connect -> sign ->
verify -> session token stored, via the wallet-auth debug logs.

Co-Authored-By: Claude Sonnet 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01YXiHuScXrjxBh7yFGAPq3B

src/entrypoints/background.ts

@@ -32,9 +32,18 @@ export default defineBackground(() => {
         return false;
 
       case 'nexa:wallet-connected':
-        handleWalletConnected(sender.tab?.id, message.walletAddress)
-          .then(() => ws.reconnectNow())
-          .catch((err) => console.debug('[nexa/background] wallet auth failed:', err)); // ws-client's own retry loop keeps trying regardless
+        // A content script reports this on every page load (it always tries
+        // a silent onlyIfTrusted connect first) — but re-authenticating
+        // means asking Phantom to sign a fresh nonce, which shows its own
+        // approval popup every time, unlike a silent connect. Only pay that
+        // cost when we don't already have a usable session.
+        getSessionToken()
+          .then(() => undefined) // already authenticated — nothing to do
+          .catch(() =>
+            handleWalletConnected(sender.tab?.id, message.walletAddress)
+              .then(() => ws.reconnectNow())
+              .catch((err) => console.debug('[nexa/background] wallet auth failed:', err)), // ws-client's own retry loop keeps trying regardless
+          );
         return false;
 
       default: