Support Phantom account switching and add sign-out

Wires Phantom's own accountChanged/disconnect provider events
(inject.ts) so switching accounts or disconnecting directly in
Phantom's UI is detected, not just our own connect/sign calls --
relayed as unsolicited postMessage events (relay.ts's onWalletEvent)
since they aren't a response to any request we made.

Adds a "Sign out" button in the popup (nexa:sign-out) that clears the
stored session, force-closes the WS connection via a new
ws-client.ts disconnect() (distinct from reconnectNow() -- it also
suppresses auto-reconnect until a new wallet connects), and asks the
content script to call provider.disconnect(), which revokes
Phantom's trust for the origin so the next silent connect correctly
fails until the user reconnects.

Fixes a real bug this surfaced: the existing "skip re-auth if a
session token exists" check in background.ts only checked for *any*
token, so switching Phantom accounts would have silently kept
authenticating as the old wallet. Session storage now tracks which
wallet it belongs to (backend-client.ts's storeSession(token,
walletAddress)) so the handler can tell "already signed in" apart
from "signed in as a different wallet than the one that just
connected."

Co-Authored-By: Claude Sonnet 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01YXiHuScXrjxBh7yFGAPq3B

src/entrypoints/popup/App.tsx

@@ -34,6 +34,10 @@ export function App() {
     return () => browser.runtime.onMessage.removeListener(listener);
   }, []);
 
+  function signOut(): void {
+    void browser.runtime.sendMessage({ type: 'nexa:sign-out' } satisfies NexaMessage);
+  }
+
   return (
     <>
       <header>
@@ -59,6 +63,12 @@ export function App() {
         )}
       </section>
 
+      {connectionStatus === 'connected' && (
+        <button type="button" className="sign-out-button" onClick={signOut}>
+          Sign out
+        </button>
+      )}
+
       <a
         className="thresholds-link"
         href="#"