fix(wallet): let a switch restart an adopted (external) daemon

Switching to a named wallet failed every time when the app had connected to a
pre-existing dragonxd at startup: the daemon is flagged externalDaemonDetected,
so stopEmbeddedDaemon()'s policy is DisconnectOnly ("not ours to stop") and the
switch skips the stop entirely. The old daemon keeps the RPC port, and the
relaunch fast-fails on EmbeddedDaemon::start()'s isPortInUse check — misread as a
bad wallet, reverting after a ~40s hang on the process-handle-only run-wait
(which reads false immediately for an adopted daemon).

A switch legitimately needs to restart the node, so:
- App::stopDaemonForWalletSwitch(): for an adopted daemon, send a graceful RPC
  "stop" using the creds we actually connected with (saved_config_) — only our
  own daemon obeys it, so a foreign dragonxd is a safe no-op — then wait (bounded
  ~40s) for the RPC port to actually free (isRpcPortInUse, the same gate start()
  uses). Owned daemons take the normal stopEmbeddedDaemon() path. No PID/name kill
  is ever issued at an adopted daemon.
- switchToWallet: gate start() on the port actually freeing; if it doesn't,
  abort with a distinct switch_stop_failed_ reason instead of starting into a busy
  port. Clear the external latch before relaunch so the fresh process is owned.
- EmbeddedDaemon::clearExternalDaemonDetected() (+ controller forwarder).
- Accurate revert message: "the running node didn't release its connection in
  time" vs. the bad-wallet message.

Root-caused from live Windows logs; design + implementation adversarially
verified. Note: beginAdoptSeedWallet has the identical pattern and is left for a
separate fund-critical review.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/app.h

@@ -415,6 +415,12 @@ public:
     // Embedded daemon control
     bool startEmbeddedDaemon();
     void stopEmbeddedDaemon();
+    // Stop the node specifically for a wallet switch, which MUST free the RPC port to relaunch on
+    // -wallet=<name>. Unlike stopEmbeddedDaemon() (whose DisconnectOnly policy leaves an adopted/external
+    // daemon running), this sends a graceful RPC "stop" — using our own connection creds, so only our
+    // daemon obeys it — even to an adopted daemon, then waits (bounded) for the port to actually release.
+    // Returns true once the RPC port is free (or we're shutting down).
+    bool stopDaemonForWalletSwitch();
     bool isEmbeddedDaemonRunning() const;
     bool isUsingEmbeddedDaemon() const { return supportsEmbeddedDaemon() && use_embedded_daemon_; }
     void setUseEmbeddedDaemon(bool use) { use_embedded_daemon_ = use && supportsEmbeddedDaemon(); }
@@ -748,6 +754,9 @@ private:
     // wallet_switch_prev_file_ (settings writes stay on the main thread) so a broken wallet isn't
     // persisted across restarts. daemon_restarting_ stays set until the revert re-arms the reconnect.
     std::atomic<bool> wallet_switch_failed_{false};
+    // Distinguishes the failure reason for the revert message: true when the switch failed because the
+    // running node wouldn't release the RPC port in time (not because the target wallet is bad).
+    std::atomic<bool> switch_stop_failed_{false};
     // True from a switch until the new wallet's daemon actually connects (onConnected). If the daemon
     // instead crash-wedges (a wallet that fails LATE in init, past the fast start grace), the connect
     // loop flags a revert so a broken wallet still can't stick.