fix(web): reject empty hex input in the auditor decoder

[karagozemin]

Problem

The web hex decoder treats an empty string or bare prefix as a valid empty byte array. In the auditor flow those values represent missing key or blob input and only fail later with a less useful cryptography error.

Task

Reject empty hex payloads with the existing invalid-hex error and add focused helper tests.

Acceptance criteria

• Empty, whitespace-only, and prefix-only inputs are rejected.
• Valid prefixed and unprefixed hex still decode correctly.
• The helper tests are included in the normal web test command.
• Web tests and typecheck pass.

Suggested implementation prompt

Add focused tests for the web hex helper, reject empty decoded payloads while preserving valid hex behavior, include the test in the web test command, and keep the change limited to this helper contract.

[emrekayat]

I'd like to work on this

[grantfox-oss]

🦊 GrantFox — @emrekayat has been assigned to this issue as part of the Third Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #251)
2. Your PR will be reviewed by the Sub-Rosa-Issue maintainers

Good luck! Track your progress on GrantFox.