Vest: the relayed login binds itself to an unset Vest firm

A Vest firm's credential is the wallet of the login it trades. It no longer
has to be typed or clicked in: when the extension relays a Vest tab's
session and a Vest firm here has no credential, that wallet is saved as the
credential (lib/vest-wallet.ts), the client starts, and the backup is
pushed.

- A saved wallet is never replaced. When the tab is signed in to another
  login, the firm now says which one and how to switch: sign in as the
  saved wallet, or remove the credential.
- With two logins relayed at once nothing binds itself; the one-click form
  decides.
- Extension 0.17.1 re-posts the session every minute even when it hasn't
  changed. The dashboard holds it in memory only, so a restart there was
  unauthenticated until the tab's next renewal (up to ~15 min); now it is
  back within a minute, and a firm created later binds within a minute too.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

extension/background.js

@@ -1208,11 +1208,15 @@ async function tick() {
 const VEST_PATTERN = 'https://next.vestmarkets.com/*';
 const VEST_URL = 'https://next.vestmarkets.com/portfolio';
 const VEST_EVERY_MS = 10_000;
+/** The session is posted again this often even unchanged: the dashboard
+ *  keeps it in memory only, so a restart there needs it back. */
+const VEST_REPOST_MS = 60_000;
 /** A Vest tab opened for the relay isn't opened again for this long. */
 const VEST_REOPEN_MS = 10 * 60_000;
 
 let vestLastCheck = 0;
 let vestLastRelayed = '';
+let vestLastPostAt = 0;
 let vestOpenedAt = 0;
 
 /** Runs in the Vest tab's MAIN world: the session vest-relay.js holds, while
@@ -1276,7 +1280,7 @@ async function relayVestSession(cfg) {
     }
 
     const fingerprint = `${found.expiresAt}:${found.accessToken.length}:${found.accessToken.slice(-16)}`;
-    if (fingerprint === vestLastRelayed) return;
+    if (fingerprint === vestLastRelayed && now - vestLastPostAt < VEST_REPOST_MS) return;
     const res = await fetch(`${cfg.apiBase}/api/vest/session`, {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
@@ -1288,9 +1292,12 @@ async function relayVestSession(cfg) {
     if (res.status === 404) throw new Error('this dashboard is too old for the Vest relay');
     if (!res.ok) throw new Error(`dashboard refused the session: ${body.reason || body.error || `HTTP ${res.status}`}`);
     vestLastRelayed = fingerprint;
+    vestLastPostAt = now;
     const short = `${found.primaryAddr.slice(0, 6)}…${found.primaryAddr.slice(-4)}`;
     const mins = Math.max(0, Math.round((found.expiresAt - Date.now()) / 60000));
-    await setState({ vest: `Relayed ${short}${body.used ? '' : ' (no Vest firm here uses this wallet)'} · good ${mins}m` });
+    const note = Array.isArray(body.bound) && body.bound.length > 0 ? ` · bound to ${body.bound.join(', ')}`
+        : body.used ? '' : ' (no Vest firm here uses this wallet)';
+    await setState({ vest: `Relayed ${short}${note} · good ${mins}m` });
 }
 
 // ── 2FA: the person's authenticator code for the firm site you are on ───────