fix(daemon): never restart, delete or swap under a node that hasn't exited

Every operation that stops the node (restart, rescan, repair, delete
chain data, reinstall, bootstrap, wallet switch/adopt/restore/rebuild,
wizard restart, encrypt, decrypt) now:

- refuses up front while the node is rebuilding witnesses or has not
  answered for 30s, with a "try again when it's done" warning, and sends
  no stop;
- goes ahead only once the node's PROCESS has exited, not its RPC port.
  A stop that doesn't finish within 120s cancels the operation (warning;
  a cancelled rescan/repair disarms its flags); nothing is started over
  the old node, chain data isn't deleted, wallet.dat isn't swapped.

Specifics:
- stopDaemonForWalletSwitch() no longer reports "stopped" when the app
  is quitting (adopt could swap wallet.dat under a live node).
- Decrypt waited a fixed 3s after "stop" before renaming wallet.dat; it
  now waits for the process to exit, and scrubs the key export if not.
- Bootstrap waits for the process before cleanChainData and stops the
  node through the stop routine instead of the shared RPC client.
- StopScope::Connected lets switch/reinstall/decrypt stop an adopted or
  external node through the same never-kill routine.
- A bounded stop that can't reach the node (a foreign node refusing our
  credentials) gives up after 5s instead of 120s.
- macOS: isDaemonProcessRunning() checks processes (libproc), not the
  RPC port.
- rpcBusyWhileAlive() also reads the busy gate: since the gate, the
  first timeout usually lands on another lane and the 30s clock never
  started (also weakened the quit prompt for a silent rebuild).
- Notifications render during the first-run wizard.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/app_network.cpp

@@ -1391,6 +1391,7 @@ void App::switchToWallet(const std::string& walletFile, bool stopDaemonConfirmed
         ui::Notifications::instance().warning("Finish or cancel the pending send before switching wallets.");
         return;
     }
+    if (refuseIfNodeBusy()) return;
     // W1-1: verify the target wallet file actually exists before switching. dragonxd auto-CREATES a
     // fresh empty wallet for a missing -wallet=<name>, so without this a moved/deleted wallet file would
     // silently "open" as a brand-new empty wallet with a zero balance — looking exactly like fund loss.
@@ -5071,6 +5072,7 @@ void App::locateSweepTxid()
 // restart with -rescan so the new keys pick up the swept funds. Runs on a background thread.
 void App::beginAdoptSeedWallet()
 {
+    if (refuseIfNodeBusy()) return;   // stays on its current step; the user retries once the node is free
     seed_migration_step_ = SeedMigrationStep::Adopting;
     seed_migration_status_ = "Restarting with your new wallet — this rescan can take a while…";
     { std::lock_guard<std::mutex> lk(seed_migration_mutex_); seed_migration_adopt_done_ = false; }
@@ -5186,6 +5188,7 @@ void App::restoreOriginalWallet()
         ui::Notifications::instance().warning(TR("wallet_restore_busy"));
         return;
     }
+    if (refuseIfNodeBusy()) return;
     // Keep the recovery dialog OPEN and drive it into the Working phase — it shows progress and the
     // honest outcome in place (pumpWalletRestore flips it to Done/Failed). Presentation only; every
     // file-safety step below is unchanged.
@@ -5353,6 +5356,7 @@ void App::rebuildWalletDatabase()
         return;
     }
     if (daemon_restarting_) { ui::Notifications::instance().warning(TR("wallet_restore_busy")); return; }
+    if (refuseIfNodeBusy()) return;
     const std::string helper = findWalletRebuildHelper();
     if (helper.empty()) { ui::Notifications::instance().error(TR("wallet_rebuild_no_helper"), 15.0f); return; }