fix(ext): generate_device_keypair returns object not JSON string

The wasm-bindgen binding for generate_device_keypair uses
serde-wasm-bindgen and returns a plain JsValue (object), not a JSON
string. Two consumers were calling JSON.parse on it, causing the
runtime error 'SyntaxError: "[object Object]" is not valid JSON' which
broke device registration end-to-end.

Fixes:
- wasm.d.ts: return type now { public_key_hex; private_key_base64 }
  matching the rate_passphrase pattern (also a JsValue-returning
  binding).
- popup-only.ts (register_this_device handler) and setup.ts (initial
  device wire-up): drop JSON.parse, use the object directly.
- router.test.ts: pin the contract — mock generate_device_keypair as a
  function returning an object (matching real binding behavior) and
  assert register_this_device returns ok and forwards the public key.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

extension/src/service-worker/router/popup-only.ts

@@ -312,7 +312,7 @@ export async function handle(
 
     case 'register_this_device': {
       if (!state.gitHost) return { ok: false, error: 'vault_locked' };
-      const keypair = JSON.parse(state.wasm.generate_device_keypair()) as {
+      const keypair = state.wasm.generate_device_keypair() as {
         public_key_hex: string;
         private_key_base64: string;
       };