fix: turn VPN off on sleep/resume and unload; harden teardown

- Detect resume (boottime-monotonic jump) and tear down the tunnel: on wake
  NetworkManager drops Mudfish's relay route and all traffic black-holes.
- Turn the tunnel off on plugin unload (Deck shutdown/restart).
- One verified teardown path for disconnect, connect failure/timeout and
  node-change failure; keep the route snapshot if tap0 stays up.
- Toggle can always turn off a stuck tunnel; status failure with tap0 up
  is reported as an error, not off.
- Re-sign in once when the cloud rejects an expired jwt.
- Expire cached pings after 10 minutes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_system.py

@@ -35,6 +35,12 @@ class SystemTest(unittest.TestCase):
         with tempfile.TemporaryDirectory() as var:
             self.assertEqual(api_base(var), "http://127.0.0.1:8282")
 
+    def test_sleep_offset_is_boottime_minus_monotonic(self):
+        from mudfish_decky.system import sleep_offset
+        clocks = {"boot": 500.0, "mono": 420.0}
+        self.assertEqual(sleep_offset(lambda c: clocks["boot"] if c == "boot" else clocks["mono"],
+                                      boot="boot", mono="mono"), 80.0)
+
     def test_ensure_daemon_noop_when_up(self):
         calls = []
         ensure_daemon("/bin/x", lambda: True, run=lambda cmd, **kw: calls.append(cmd))