feat(daemon): deliver stop reliably and never kill the node unasked

Closing the wallet sent "stop" at most twice, gated on a getinfo probe
that needs the daemon's cs_main, then killed the node after 20 s (Windows)
or 30 s (POSIX) whether or not stop had arrived. A node busy with an
hour-long witness rebuild therefore never got stop, was killed mid-
rebuild, and replayed everything since its last flush on every start.

Delivery (src/daemon/stop_delivery.h, RPCClient::open/trySendStop):
- stop goes over a dedicated client with no probe, so it never waits on
  rpc_'s lock or a cs_main-bound getinfo
- every attempt is classified, and StopDeliveryPolicy decides the next:
  Accepted / 503 = delivered; Queued (reply timeout) is resent at most
  every 30 s; QueueFull / not listening are retried every 1.5 s; a
  refusal after we were heard means the node is shutting down; a 401 on
  our own node tries the next credential source
- POSIX: a group SIGTERM goes out as soon as an attempt fails, which
  bypasses the HTTP queue entirely

Waiting (DaemonController::executeDaemonStop, pure, virtual-clock
tested):
- never kills on its own. Quitting waits as long as the node needs; the
  shutdown screen offers "Close wallet — leave node running" after 3 s,
  and "Kill node (unsafe)" (confirmed) only once stop was delivered and
  the node showed no CPU/I-O progress for ~10 min outside a rebuild
- other callers (restart, rescan, reinstall, switch, ...) wait up to
  120 s, let go once the app starts quitting, and keep watching a node
  that is still running; wallet switch refuses to go ahead then
- EmbeddedDaemon gains stop-session primitives (beginStop,
  pollOwnedProcess, signalGracefulStop, forceKillOwnedProcess,
  ownedResourceUsage over the Linux process group / Windows handle,
  endStop) and only one stop session runs at a time
- the Force Quit button and its stall heuristic are gone; "Leave
  running" aborts a pending stop attempt and closes at once

Verified against the fake daemon with the real GUI: closing mid-rebuild
now delivers stop (or SIGTERM 2 ms after a queue-full refusal) and the
node exits cleanly after its rebuild, where it was SIGKILLed before. The
shutdown screen, its "Leave running" button and the idle Kill offer
(after ~11 min) were checked by screenshot. New strings are English-
only for now.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/rpc/rpc_client.cpp

@@ -163,6 +163,17 @@ bool RPCClient::connect(const std::string& host, const std::string& port,
                         bool useTls)
 {
     std::lock_guard<std::recursive_mutex> lk(curl_mutex_);
+    if (!open(host, port, user, password, useTls)) return false;
+    return probeConnection(host);
+}
+
+bool RPCClient::open(const std::string& host, const std::string& port,
+                     const std::string& user, const std::string& password,
+                     bool useTls)
+{
+    std::lock_guard<std::recursive_mutex> lk(curl_mutex_);
+    connected_ = false;     // only a successful probe (connect()) sets these
+    warming_up_ = false;
     host_ = host;
     port_ = port;
     last_connect_info_ = json();
@@ -218,7 +229,11 @@ bool RPCClient::connect(const std::string& host, const std::string& port,
     // build defaults. Harmless on the localhost http:// case; essential for a remote https daemon.
     curl_easy_setopt(impl_->curl, CURLOPT_SSL_VERIFYPEER, 1L);
     curl_easy_setopt(impl_->curl, CURLOPT_SSL_VERIFYHOST, 2L);
+    return true;
+}
 
+bool RPCClient::probeConnection(const std::string& host)
+{
     // Test connection with getinfo. Use a SHORT timeout for the probe on localhost: a healthy
     // local daemon answers in milliseconds and a warming one returns -28 just as fast, so a long
     // hang means a wedged/loading occupant — no point blocking the full 30s before we retry and
@@ -286,6 +301,17 @@ void RPCClient::logConnectFailure(const std::string& msg)
         DEBUG_LOGF("Connection failed %s (repeated %u times)\n", line.c_str(), connect_error_repeats_);
 }
 
+RpcFailureKind RPCClient::trySendStop(long timeoutSec)
+{
+    try {
+        TraceScope trace("Daemon lifecycle / Stop command");
+        call("stop", json::array(), timeoutSec);
+        return RpcFailureKind::None;
+    } catch (const std::exception& e) {
+        return rpcFailureKindOf(e);
+    }
+}
+
 json RPCClient::getLastConnectInfo() const
 {
     std::lock_guard<std::recursive_mutex> lk(curl_mutex_);