fix(core): drive auto-lock idle from real input, not widget focus

The auto-lock idle clock was reset whenever any ImGui item was active,
so a text field left focused (a half-filled send form, say) counted as
continuous activity and kept the wallet unlocked indefinitely, well past
the configured idle timeout.

- The idle clock is now fed by real input events (key, text, mouse,
  touch, pen, gamepad button) as they are ingested on the main thread,
  plus a still-held mouse button so a drag or scrollbar grab that emits
  no new event still counts. A focused but untouched widget no longer
  does.
- A new header-only IdleTracker owns the clock and never moves backwards,
  so an event stamped before the previous one cannot shorten the idle
  time.

Behaviour change: a form left focused and idle past the timeout now
auto-locks. The form's buffers are app state and survive the lock and
unlock, so nothing typed is lost.

Tests: a new IdleTracker case covers idle time growing with no events
(enough to trip a 900s lock), activity resetting it, the clock never
moving backwards, and a query before the last activity reading zero
rather than a negative value.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/app.h

@@ -43,6 +43,7 @@
 #include "util/background_sampler.h"
 #include "util/coalescing_writer.h"
 #include "util/fetch_backoff.h"
+#include "util/idle_tracker.h"
 #include "util/pool_stats_service.h"
 #include "wallet/wallet_capabilities.h"
 #include "chat/chat_service.h"
@@ -559,6 +560,9 @@ public:
     // output parser skips while the wallet is locked), so a background witness rebuild that started and
     // finished meanwhile isn't parsed in one batch and mistaken for a completed rescan (spurious toast).
     void skipDaemonOutputBacklog();
+    // A real user input event (key, text, mouse, touch, pen, gamepad button) was ingested. Main thread only.
+    // Called from main.cpp's noteEvent; do NOT call from an SDL event watch/filter (resizeWatcher).
+    void noteUserInput() { idle_.noteActivity(); }
     void refreshMiningInfo();
     void refreshPeerInfo();
     void refreshMarketData();
@@ -1935,8 +1939,9 @@ private:
     char wizard_pin_confirm_buf_[16] = {};
     std::string wizard_pin_status_;
 
-    // Auto-lock on idle
-    std::chrono::steady_clock::time_point last_interaction_ = std::chrono::steady_clock::now();
+    // Auto-lock on idle. Fed by real input events (noteUserInput, from main.cpp's event ingest), NOT by
+    // widget state: a focused-but-untouched text field must not keep the wallet unlocked (C21).
+    util::IdleTracker idle_;
 
     // Wall-clock delta for logic timers (see logicDeltaTime()).
     std::chrono::steady_clock::time_point last_update_time_{};