This more closely matches the behavior of JS and Py. The idea is that
one address could have multiple signers, although I'm not sure how
common that actually is. This definitely feels more correct, but if
there are downsides I'm not seeing we could revert it

refactoring pqsig-support

Collapse the repeated signature-length checks, delegation-signature counting, JSON-based signer equality, and per-index signing loops into shared helpers within each package.

Two of the deduplicated call sites, the program signers in makeLogicSig and Ed25519AppendMultisigToLogicSig, previously copied the raw signature without checking its length, silently accepting a short signature from a custom Ed25519Signer as a subsig. They now return errInvalidSignatureReturned like every other signing path.

Move the PQ golden tests to the transaction package so they exercise PQAccountTransactionSigner directly, and drop signPQAccountTransactionFixture, a test-only reimplementation of the signing envelope that could have passed while the real signer was broken. Add coverage for the rekeyed PQ signer.

Move scheme-specific signed transaction construction into the
transaction package and expose a scheme-neutral SignTransaction helper.
Preserve the legacy signing APIs and public API compatibility.

Public nodes can disable API auth. Always setting X-Algo-API-Token to an
empty string caused those requests to fail. Only send the header when
both the header name and token are non-empty.

Fixes #653.