fix(web): reject empty hex input in the auditor decoder

[s6pa1rta3n-lab]

Summary of Changes

• Auditor Decoder (apps/web/src/lib/hex.ts): Updated hexToBytes to reject empty (""), whitespace-only (" "), and prefix-only ("0x", "0X") strings with Error("invalid hex string") instead of returning an empty byte array.
• Unit Tests (apps/web/src/lib/hex.test.ts): Added comprehensive tests covering empty inputs, whitespace-only, prefix-only, odd length, invalid characters, valid prefixed/unprefixed strings, whitespace trimming, byte encoding, and round-trips.
• Test Script (apps/web/package.json): Included src/lib/hex.test.ts in the web workspace test command.

Closes #251

Acceptance Criteria Checklist

• Empty, whitespace-only, and prefix-only inputs are rejected with "invalid hex string".
• Valid prefixed and unprefixed hex still decode correctly.
• Helper tests are included in the normal web test command.
• Web tests (pnpm web:test) and typecheck (pnpm web:typecheck) pass.

Payout Routing

• EVM (Base/Arbitrum/Polygon/ETH): 0xF46C9F6d70C50BF81ef3588AB523a90a594a2F89
• Stellar: GCL6OXAMLD75BMTINA6EMRUDWK5THQUSHMYNLSNBCJAPZJHNYJTUNIBC