feat(daemon): deliver stop reliably and never kill the node unasked

Closing the wallet sent "stop" at most twice, gated on a getinfo probe
that needs the daemon's cs_main, then killed the node after 20 s (Windows)
or 30 s (POSIX) whether or not stop had arrived. A node busy with an
hour-long witness rebuild therefore never got stop, was killed mid-
rebuild, and replayed everything since its last flush on every start.

Delivery (src/daemon/stop_delivery.h, RPCClient::open/trySendStop):
- stop goes over a dedicated client with no probe, so it never waits on
  rpc_'s lock or a cs_main-bound getinfo
- every attempt is classified, and StopDeliveryPolicy decides the next:
  Accepted / 503 = delivered; Queued (reply timeout) is resent at most
  every 30 s; QueueFull / not listening are retried every 1.5 s; a
  refusal after we were heard means the node is shutting down; a 401 on
  our own node tries the next credential source
- POSIX: a group SIGTERM goes out as soon as an attempt fails, which
  bypasses the HTTP queue entirely

Waiting (DaemonController::executeDaemonStop, pure, virtual-clock
tested):
- never kills on its own. Quitting waits as long as the node needs; the
  shutdown screen offers "Close wallet — leave node running" after 3 s,
  and "Kill node (unsafe)" (confirmed) only once stop was delivered and
  the node showed no CPU/I-O progress for ~10 min outside a rebuild
- other callers (restart, rescan, reinstall, switch, ...) wait up to
  120 s, let go once the app starts quitting, and keep watching a node
  that is still running; wallet switch refuses to go ahead then
- EmbeddedDaemon gains stop-session primitives (beginStop,
  pollOwnedProcess, signalGracefulStop, forceKillOwnedProcess,
  ownedResourceUsage over the Linux process group / Windows handle,
  endStop) and only one stop session runs at a time
- the Force Quit button and its stall heuristic are gone; "Leave
  running" aborts a pending stop attempt and closes at once

Verified against the fake daemon with the real GUI: closing mid-rebuild
now delivers stop (or SIGTERM 2 ms after a queue-full refusal) and the
node exits cleanly after its rebuild, where it was SIGKILLed before. The
shutdown screen, its "Leave running" button and the idle Kill offer
(after ~11 min) were checked by screenshot. New strings are English-
only for now.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/app.h

@@ -21,6 +21,7 @@
 #include "data/wallet_index.h"
 #include "data/wallet_state.h"
 #include "rpc/connection.h"
+#include "daemon/stop_delivery.h"
 #include "services/network_refresh_service.h"
 #include "services/wallet_security_controller.h"
 #include "services/wallet_security_workflow.h"
@@ -480,7 +481,13 @@ public:
     
     // Embedded daemon control
     bool startEmbeddedDaemon();
-    void stopEmbeddedDaemon();
+    // How long stopEmbeddedDaemon() may wait, and who decides. It never kills the node on its own.
+    enum class StopMode {
+        AppShutdown,  // quitting: no time limit; the shutdown screen offers "Leave running" (and "Kill" when stuck)
+        Background,   // restart/rescan/switch/...: up to 120s, and let go as soon as the app starts quitting
+        Fallback,     // the synchronous shutdown fallback on the UI thread: up to 20s
+    };
+    daemon::StopOutcome stopEmbeddedDaemon(StopMode mode = StopMode::Background);
     // Stop the node specifically for a wallet switch, which MUST free the RPC port to relaunch on
     // -wallet=<name>. Unlike stopEmbeddedDaemon() (whose DisconnectOnly policy leaves an adopted/external
     // daemon running), this sends a graceful RPC "stop" — using our own connection creds, so only our
@@ -632,6 +639,8 @@ public:
 
 private:
     friend class AppDaemonLifecycleRuntime;
+    friend class AppStopRuntime;
+    friend class AppStopTaskContext;
     friend class AppDaemonLifecycleTaskContext;
 
     // Global keyboard-shortcut handling, dispatched once per frame from update().
@@ -964,9 +973,19 @@ private:
     bool shutdown_confirmed_ = false;             // user chose to proceed — bypass the guard on re-entry
     bool shutdown_keep_daemon_override_ = false;  // user chose "keep node running" for this shutdown only
     float shutdown_timer_ = 0.0f;
-    bool force_quit_confirm_ = false;
     std::chrono::steady_clock::time_point shutdown_start_time_;
 
+    // One stop session at a time (stopEmbeddedDaemon), and the shutdown screen's view of it.
+    std::mutex stop_mutex_;
+    std::atomic<bool> stop_session_active_{false};
+    std::atomic<int> stop_user_choice_{0};        // daemon::StopUserChoice, set by the shutdown screen
+    std::atomic<bool> stop_kill_offered_{false};  // the node looks stuck: the screen may offer "Kill"
+    std::atomic<int> stop_idle_minutes_{0};
+    std::mutex stop_client_mutex_;
+    rpc::RPCClient* active_stop_client_ = nullptr;  // aborted on "Leave running" so a pending attempt ends at once
+    bool stop_kill_confirm_ = false;
+    void chooseStopAction(daemon::StopUserChoice choice);
+
     // Daemon restart (e.g. after changing debug log categories)
     std::atomic<bool> daemon_restarting_{false};