fix(examples): keep the Blockfrost key out of the vite-react bundle

[0xBora]

Why

The Vite example reads its Blockfrost key from VITE_BLOCKFROST_PROJECT_ID, and Vite copies every VITE_ variable into the JavaScript the browser downloads. A build with a dummy key shows it in dist/assets/index-*.js. The wallet security guide lists this as a common mistake ("Wrong: Provider Keys in Frontend") and recommends the server-builds, browser-signs split, which the example did not follow.

Two smaller bugs sat next to it: ADA amounts were truncated (1.005 ADA sent 1,004,999 lovelace), and the wallet's network limit followed the build mode, so a production build refused testnet wallets even with VITE_NETWORK=preprod.

What changes

• server/payments.ts builds the payment with the key and submits the signed transaction, following the sample in clients/architecture/frontend-backend. The browser client uses only withCip30.
• pnpm dev serves the API through a small Vite plugin; pnpm build && pnpm start serves it with the built app. No new runtime dependency.
• Amounts round to lovelace, the recipient must be on the configured network, and the network limit follows VITE_NETWORK.
• BLOCKFROST_PROJECT_ID replaces VITE_BLOCKFROST_PROJECT_ID, and the README shows the new flow.

Verified

• type-check and build pass, the files pass the repo's ESLint and Prettier, and pnpm install --frozen-lockfile works with the updated lockfile.
• With a dummy key set, the key is absent from dist/.
• The API rejects bad input, a wrong-network address and a missing key through both the dev and the production server.
• Against real preprod data, the same build chain (with Koios standing in for Blockfrost) produced a valid payment, and the browser's merge step added a real signature without changing the body.
• Not verified: a sign and submit through a browser wallet.