refactor: split setupDashClient into browser-safe core and Node wrapper (#68)

* refactor: split setupDashClient into browser-safe core and Node wrapper

Extract createClient, IdentityKeyManager, AddressKeyManager, dip13KeyPath, and
KEY_SPECS into setupDashClient-core.mjs so browser apps can import them without
pulling in dotenv or process.env. setupDashClient.mjs keeps the Node-only
convenience layer and re-exports the core API so existing tutorial imports
continue to work unchanged.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix: strictly validate hex chunks in setupDashClient hexToBytes

parseInt(chunk, 16) silently accepted inputs like "1z" as 1, so the
NaN guard let non-hex characters through and produced wrong bytes.
Validate each 2-char chunk against /^[0-9A-Fa-f]{2}$/ before
conversion and replace the deprecated substr with slice. Adds a
regression test that poisons publicKey with "1z" and asserts the
hexToBytes error references the bad offset.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: thephez