fix: turn VPN off on sleep/resume and unload; harden teardown

- Detect resume (boottime-monotonic jump) and tear down the tunnel: on wake
  NetworkManager drops Mudfish's relay route and all traffic black-holes.
- Turn the tunnel off on plugin unload (Deck shutdown/restart).
- One verified teardown path for disconnect, connect failure/timeout and
  node-change failure; keep the route snapshot if tap0 stays up.
- Toggle can always turn off a stuck tunnel; status failure with tap0 up
  is reported as an error, not off.
- Re-sign in once when the cloud rejects an expired jwt.
- Expire cached pings after 10 minutes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

py_modules/mudfish_decky/system.py

@@ -57,6 +57,12 @@ def ensure_daemon(bin_path: str, is_up: Callable[[], bool], run=subprocess.run,
             return
 
 
+def sleep_offset(clock=time.clock_gettime, boot=getattr(time, "CLOCK_BOOTTIME", None),
+                 mono=time.CLOCK_MONOTONIC) -> float:
+    """Total time spent suspended since boot: BOOTTIME keeps counting during suspend, MONOTONIC doesn't."""
+    return clock(boot) - clock(mono)
+
+
 def tap_up() -> bool:
     return os.path.exists("/sys/class/net/tap0")