Vest: the relayed login binds itself to an unset Vest firm

A Vest firm's credential is the wallet of the login it trades. It no longer
has to be typed or clicked in: when the extension relays a Vest tab's
session and a Vest firm here has no credential, that wallet is saved as the
credential (lib/vest-wallet.ts), the client starts, and the backup is
pushed.

- A saved wallet is never replaced. When the tab is signed in to another
  login, the firm now says which one and how to switch: sign in as the
  saved wallet, or remove the credential.
- With two logins relayed at once nothing binds itself; the one-click form
  decides.
- Extension 0.17.1 re-posts the session every minute even when it hasn't
  changed. The dashboard holds it in memory only, so a restart there was
  unauthenticated until the tab's next renewal (up to ~15 min); now it is
  back within a minute, and a firm created later binds within a minute too.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

extension/README.md

@@ -87,8 +87,9 @@ log in to Vest by itself. The extension relays the browser's session instead:
 
 ```
 vest-relay.js (Vest tab, MAIN world)   keeps the access token the Vest app last renewed
-background.js  relayVestSession        lifts it every 10s, posts it when it changes
-dashboard      POST /api/vest/session  holds it in memory for the firm's Vest client
+background.js  relayVestSession        lifts it every 10s, posts it when it changes (and every minute)
+dashboard      POST /api/vest/session  holds it in memory for the firm's Vest client,
+                                       and binds an unset Vest firm to the login's wallet
 ```
 
 - The hook only reads the Vest app's own `/v3/auth/refresh` and `/register`