fix: detect KeepKey hot-swap + drop stale cache on device change

[BitHighlander]

Summary

The extension treated any reachable vault as a reachable device, with no validation that the device currently paired with the vault is the same one whose pubkeys we cached. Three failure modes became silent:

1. Hot-swap on same vault — `checkKeepKey` kept `state.deviceConnected = true` and never re-probed, so addresses/balances pinned to the old device indefinitely.
2. Extension reload with a new device — `init()` loaded the old pubkey cache without comparing deviceId against the freshly-probed one, so cached addresses survived even a full BEX reload.
3. Vault auth rejection (stale apiKey after re-pair) — `fetchPubkeys` caught the error and silently fell back to cached pubkeys from the previous device, masking the re-pair requirement.

Fix (four narrow changes)

• `wallet.init()` compares cached `deviceInfo.deviceId` to the freshly-probed one when a device is reachable; mismatch → clear storage before `fetchPubkeys` runs. (Case 2.)
• `wallet.handleDeviceSwitch()` primitive clears in-memory pubkeys/paths, resets `deviceConnected`, and wipes `pubkeyStorage`. Keeps the SDK alive — only device-specific state is dropped.
• `background/index.ts` `checkKeepKey` now runs a periodic (30s, throttled) `getFeatures` re-probe while `deviceConnected`. Compares before/after deviceId; on mismatch calls `handleDeviceSwitch` which clears balance cache, per-chain address caches (Solana/Tron/TON), and triggers a fresh pubkey + balance refresh. (Case 1.)
• `fetchPubkeys` no longer silently falls back to cache on auth errors. Detects 401/"unauthorized"/"not paired" shapes, clears the stored apiKey, and throws a user-facing message for the sidebar to surface. Non-auth failures (network blip, device busy) still fall back to cache as view-only — that path was always correct. (Case 3.)

Recovery from device swap is now automatic within ~30s on steady state, immediate on extension reload.

Test plan

• Plug device A, open side panel, note address. Without closing anything, physically swap to device B. Within 30s: `[Device swap detected. Purging caches and re-fetching.]` in service-worker console + side panel addresses update to B.
• Plug device A, close everything, swap cable so B is plugged. Reload extension: `[Device changed: cache= → probed=. Invalidating cache.]` + side panel shows B's addresses immediately, not A's.
• Re-pair the extension's apiKey on the vault side while the extension is running: signing action → `"Vault auth failed. Your KeepKey needs to be re-paired..."` toast, not silent stale cache.

Dependencies

None — sits cleanly on develop. Independent of PR #46, #47, #48.

🤖 Generated with Claude Code