v0.13.1 — live keyless Mercury discovery

Live signer discovery via Mercury's hosted, keyless passkey-indexer — plus removal of the paths that no longer earn their keep. No contract change; bindings (passkey-kit-sdk 0.7.3, sac-sdk 0.4.3) and the canonical WASM 84924c53… are unchanged.

Highlights

• Keyless Mercury discovery, live on both networks. MercuryIndexer queries Mercury's public passkey-indexer REST API (https://{testnet,mainnet}.mercurydata.app/rest/passkey-indexer) — no JWT/API key — with full history across both signer generations (legacy ("sw_v1", …) tuples and the v1 #[contractevent]s). It returns fully-decoded signers mapped straight onto WalletSigner. New MercuryIndexer.forNetwork() / mercuryPasskeyIndexerUrl() / MERCURY_PASSKEY_INDEXER_URLS.
• MercuryIndexer is now browser-safe — exported from the main passkey-kit entry (it holds no secret), so you can call it directly from the browser with no proxy.
• Demo calls Mercury directly — the old indexer-proxy indirection and backend toggle are gone.
• Hardening preserved — with an rpc, evicted temporary signers are flagged and reverse-lookup candidates are confirmed on-chain before being trusted.

Breaking (pre-1.0)

• StellarIndexerBackend / StellarIndexerConfig / indexerForConfig removed (mainnet-only, never had a live testnet path; Mercury now covers both networks). SignerIndexer has one implementation.
• IndexedSigner type removed — PasskeyServer.getSigners returns WalletSigner[].
• MercuryIndexer moved from passkey-kit/server to the main passkey-kit entry.
• MercuryConfig collapsed to an optional { url? } (defaults to the network's hosted endpoint); projectName/jwt/apiKey and the interim zephyrExecuteConfirmed gate are gone.
• The zephyr/ self-host indexer program was removed.

See the CHANGELOG and migration guide.