fix: stop the unbond settle from stalling every other peripheral's connect

[MegaManSec]

Stacked on #108 — review that first; this targets its branch and will retarget to main when it merges.

Unbond settle stops stalling the queue

removeStaleBond slept 0.5s on bluetoothQueue to let -remove settle. That queue is serial and shared by every in-flight connect, so a full-set switch served peripherals one at a time, each waiting out its predecessors' unbonds. The later rows spent longest bonded to no Mac at all — the window in which macOS answers the peripheral's own reconnect with the "Connection Request" panel from #109 instead of our pair session.

• Wait by yielding the queue: removeStaleBond re-enqueues via asyncAfter and hands the re-fetched handle to a completion. The pair start moves into startDevicePair so both paths share it, and the completion re-checks isCurrentAttempt since the gap is now supersedable.
• An escalated refresh pairs blind instead of re-probing RSSI after the teardown. The gate above it already established reachability, and the second probe both widened the window and could abandon the attempt with the bond already gone.

The blind teardown becomes recoverable

#108's takeover escalation removes a bond with no RSSI check, reasoning that a peer which just released (or vanished) leaves a device that's free but too idle to answer the probe. That's right, and it's what unsticks a take from a locked peer — but it's a guess, and two things stopped it being a safe one.

• The watcher's retries are what pay for a wrong guess, but armReconnect preserves an existing entry's arm time, so reconnectMaxWindow counts from the original drop. A teardown minutes into an existing watch inherited almost no time to re-pair. armReconnectForBondRepair restarts the window from the teardown, and arms a peripheral whose caller never did. It leaves the entry's reclaim/adoption flavour alone, so the adoption attempt cap still applies.
• Those retries don't exist at all when "reconnect peripherals if they drop" is off. The blind escalation is now conditional on it; otherwise the unanswered probe keeps its bond. Read via UserDefaults rather than the @AppStorage wrapper, which the Bluetooth queue can't safely touch.
• A failure after a teardown stops being silent. It leaves the peripheral paired to nothing, which no retry cadence undoes for the user, so it reports through the announce and watcher gates that suppress an ordinary failure.

Verified with swift format only — no Xcode on this machine, so this hasn't been built or run against hardware.