refactor(machine): wire LnbitsClient alongside LightningPubClient

3b.1 of the LP→LNbits migration: structurally introduce LnbitsClient
into services/lightning.ts without changing any runtime behavior.
All existing call sites still go through LightningPubClient.

  apps/machine/src/services/lightning.ts
    - import LnbitsClient from @bitSpire/lnbits
    - add `lnbitsServerPubkey` to LightningConfig
    - load it from runtime IPC config + VITE_LNBITS_SERVER_PUBKEY
      env var (env wiring proper happens in 3c)
    - module-level `_lnbitsRef: LnbitsClient | null`
    - in initializeLightningServices, instantiate LnbitsClient
      ONLY IF `CONFIG.lnbitsServerPubkey` is set (graceful no-op
      while the env hasn't been wired yet)
    - export `_getLnbitsClient()` for 3b.2+ call sites

  apps/machine/package.json
    - add `@bitSpire/lnbits: workspace:*` dependency

Verified: pnpm typecheck clean (14/14 turbo tasks, machine task
now executes since lnbits is a new dep).

Next: 3b.2 — drop the CLINK/ndebit cash-in flow.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/machine/package.json

@@ -24,6 +24,7 @@
     "@bitSpire/clink": "workspace:*",
     "@bitSpire/hal": "workspace:*",
     "@bitSpire/lightning": "workspace:*",
+    "@bitSpire/lnbits": "workspace:*",
     "@bitSpire/nostr-client": "workspace:*",
     "@bitSpire/state-machine": "workspace:*",
     "@scure/base": "^1.2.0",