feat: add XBullWallet adapter implementation (Closes #488)

[waterWang]

Summary

Implements XBullWallet in apps/web/src/lib/wallet.ts, a third WalletAdapter implementation alongside FreighterWallet and LobstrWallet, targeting the xBull Stellar wallet.

xBull is mobile-first (unlike Freighter, which is desktop-only), so it is a real path to reaching the low-end Android users the roadmap targets — the issue explicitly scopes this to the adapter implementation only, with a wallet-picker to follow later.

Implementation

• XBullWallet implements WalletAdapter with all four methods:
  • isInstalled() — checks for window.xBullSDK (injected by the xBull browser extension)
  • connect() — calls sdk.connect({ canRequestPublicKey: true, canRequestSign: true }) then sdk.getPublicKey()
  • isAuthorized() — xBull has no passive site-permission query (no isAllowed equivalent; the only grant flow is connect(), which prompts). Mirrors the LobstrWallet stored-key pattern: a successful connect() writes the public key to sessionStorage (meridian-xbull-public-key), and isAuthorized() treats installed + stored key as authorized. This keeps revalidate() (which runs on mount and focus) non-prompting.
  • sign() — passes networkPassphrase through to sdk.signXDR(xdr, { network }), throws "Signing cancelled" on falsy return
• Every method short-circuits through the existing withMockWallet() helper, so Playwright e2e tests can exercise the connect/sign paths without a real extension — same pattern as FreighterWallet/LobstrWallet.

Tests

New file apps/web/src/__tests__/lib/xbull-wallet.test.ts (207 lines), mirroring the structure of lobstr-wallet.test.ts:

• Real xBull path (stubbed window.xBullSDK): isInstalled true/false, isAuthorized stored-key semantics (incl. a "never calls connect/getPublicKey passively" guard), connect success + key storage + permissions payload, connect error paths (SDK missing, empty key), sign success, signXDR receives networkPassphrase, sign error paths (SDK missing, cancel, propagated rejection)
• E2E mock wallet path: short-circuiting for all four methods and rejection propagation

Verification

• pnpm --filter @meridian/web lint — no new lint errors
• pnpm --filter @meridian/web test — all wallet tests pass (existing Freighter/LOBSTR + new xBull suite)

Closes #488

[vercel]

Someone is attempting to deploy a commit to the Collins' projects Team on Vercel.

A member of the Team first needs to authorize it.