Expose account public key on connect

[droplister]

Summary

• adds a rich account object to xcp_requestAccounts responses
• includes publicKey and xOnlyPublicKey for the active connected account
• keeps xcp_accounts unchanged as a string[] compatibility method
• avoids exposing path, xpub, private key, mnemonic, or all addresses

Verification

• npx.cmd vitest run src/services/tests/providerService.test.ts src/services/tests/providerService.security.test.ts

Note: npm.cmd run compile is currently blocked by unrelated existing D1 type errors in apps/api/src/indexer/pools.ts.