fix(net): detect a silently-dead live stream via a heartbeat watchdog

An idle live stream whose connection dies without an error (airplane mode
cutting the radio) left the net-state machine stuck "online": the streaming
fetch neither errored nor delivered, no unary call was made, and the OS
`navigator` offline hint is unreliable in the Telegram/VK WebViews — so the
"Connecting…"/offline state only surfaced on the next foreground resync, not
while idle.

The gateway already pushes a keep-alive `heartbeat` every 10s, so add a
client-side watchdog (streamwatchdog.ts) that resets on every delivered event
and, after ~25s of silence, treats the stream as dropped (reportOffline +
reconnect). It is background-aware (paused while suspended) so a throttled
foreground return does not false-trip. The mock client mirrors the heartbeat
so an idle e2e session stays online.

docs/ARCHITECTURE.md

@@ -107,8 +107,10 @@ dropped). Horizontal scaling is explicit future work.
   the header **"Connecting…"** spinner, chrome stays online); `offlineNoNetwork` (sustained loss — blue
   chrome, a local-only lobby, the transport **kill switch**); and `offlineVersionLocked` (the gateway is
   reachable but the build is below the hard minimum — the *update* notice, the client-version gate below). **Offline is
-  implicit** — detected from failed calls, a reachability probe and the OS hint (`navigator` /
-  `@capacitor/network`), **never a user toggle** — with **hysteresis** so a brief blip lives entirely in
+  implicit** — detected from failed calls, a reachability probe, a **live-stream heartbeat watchdog**
+  (a silence past ~25 s of the gateway's 10 s keep-alive `heartbeat` means a silently-dead stream — e.g.
+  the radio was cut with no stream error; `ui/src/lib/streamwatchdog.ts`, background-aware) and the OS hint
+  (`navigator` / `@capacitor/network`), **never a user toggle** — with **hysteresis** so a brief blip lives entirely in
   `connecting` (K consecutive probe failures *or* a debounce window trips `offlineNoNetwork`; the first
   probe/call success heals back, with a toast). The transport **auto-retries with capped exponential
   backoff** — every op on a rate-limit (the gateway rejected it before processing, so it is safe), but