Align browser-bridge socket with launcher via just demo-bridge/qa-bridge

[hellno]

Summary

The browser bridge resolves DECKARD_SOCKET_PATH through WalletClient::from_env, but just demo and just qa launch the app with world-specific sockets, so running the bridge in a separate terminal without that env fell back to the per-uid default socket and reported a misleading "daemon not running" error even though the supervised daemon was up on the world socket. This PR adds just demo-bridge and just qa-bridge recipes that reuse each launcher's own socket and chain vars so the bridge can no longer dial the wrong daemon, promotes the qa world constants to top-level qa_* vars (mirroring demo_*) with byte-identical values, makes the bridge log which socket it dials in real mode instead of always claiming dev-mock, and updates docs/browser-bridge.md to use the recipes instead of the env-less command that reproduced the trap.

Linked issue

No tracking issue. Motivation: a local debugging session hit a confusing browser-bridge 4900 because the bridge defaulted to a socket the demo/qa launchers never use. This removes that footgun by construction rather than by documentation alone.

Definition of Done

• cargo fmt --all --check is clean
• just check is green — clippy -D warnings on both the default config and --features tray
• cargo test --workspace is green
• No new or changed dependencies in Cargo.toml / Cargo.lock
• No visual/UI change (no GPUI view touched; the only new output is a serve() stderr startup line), so DESIGN.md does not apply
• Secrets stay in Zeroizing and are never logged — the new startup log prints only the socket path and chain id, never a seed/key/passphrase

Evidence (paste command output here)

$ cargo fmt --all --check
# (no output, exit 0 — clean)

$ just check
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 1m 45s   # default config
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 19.04s   # --features tray
# clippy -D warnings, both configs, exit 0

$ TMPDIR=/tmp cargo test --workspace
cargo test: 250 passed, 2 ignored (32 suites, 6.78s)   # 0 failed

Notes for reviewers

• The bridge already read the env contract via WalletClient::from_env; the gap was purely operational (the launchers exported the world socket/chain to the app process only, not to the bridge's terminal). The new recipes derive the bridge's DECKARD_SOCKET_PATH/DECKARD_CHAIN_ID from the same just vars the app launch uses, so they cannot drift.
• cargo test --workspace must run with TMPDIR=/tmp on macOS: without it, deckard-signerd's resolve_accepted_on_control_channel socket test fails with "daemon never bound its socket" because the long /var/folders/... $TMPDIR path exceeds the 104-byte SUN_LEN limit. This is a known env artifact, not a regression from this change, and is unrelated to the touched crates.
• A new WalletClient::socket_path() getter (delegating to the existing SignerClient::path()) backs the startup log. No RPC behavior, supported-method set, or types changed.
• Cross-model adversarial review (Codex) verdict: goal achieved, borrow ordering in serve() is sound, the qa refactor preserves exact env values.