feat(signer): scaffold the package and enforce the no-network boundary

The signer's security claim is that it cannot reach the network, not that it
chooses not to. test/boundary.test.ts enforces that mechanically over both the
import graph and the manifest.

package-lock.json

@@ -42,6 +42,10 @@
       "resolved": "packages/shared",
       "link": true
     },
+    "node_modules/@apexfusion/vector-mcp-signer": {
+      "resolved": "packages/signer",
+      "link": true
+    },
     "node_modules/@aws-sdk/checksums": {
       "version": "3.1000.20",
       "resolved": "https://registry.npmjs.org/@aws-sdk/checksums/-/checksums-3.1000.20.tgz",
@@ -7893,6 +7897,22 @@
         "@noble/hashes": "^1.7.1",
         "cross-fetch": "^4.0.0"
       }
+    },
+    "packages/signer": {
+      "name": "@apexfusion/vector-mcp-signer",
+      "version": "0.1.0",
+      "dependencies": {
+        "@anastasia-labs/cardano-multiplatform-lib-nodejs": "6.0.2-3",
+        "@lucid-evolution/wallet": "^0.1.72",
+        "@modelcontextprotocol/sdk": "^1.4.1",
+        "zod": "^3.24.1"
+      },
+      "bin": {
+        "vector-mcp-signer": "build/index.js"
+      },
+      "devDependencies": {
+        "@apexfusion/vector-mcp-shared": "*"
+      }
     }
   }
 }