fix(connection): half-open detection (TCP_USER_TIMEOUT) + Connect/Disconnect toggle

[HarryCordewener]

Symptom

You run a command and nothing comes back — the connection is actually dead (server gone / network dropped), but the client sits Connected, showing the local echo with no server response, until you force a reconnect.

Cause

SO_KEEPALIVE / TcpKeepAliveTime (added earlier) only probe an idle socket. The instant a command — or the 45s NOP heartbeat — is sent, that data is in flight; on a half-open peer it's never acknowledged, so keepalive never runs. TCP instead retransmits the unacked data for ~15 minutes (tcp_retries2) before failing, and the read loop stays blocked the whole time, so no auto-reconnect fires.

Fix

Set TCP_USER_TIMEOUT (Linux/Android) to 20s — it bounds how long unacknowledged in-flight data is retransmitted before the OS fails the socket. A half-open connection now surfaces in ~20s → the read loop completes → the existing monitor auto-reconnects (and, per the auto-login fix, re-authenticates).

Key property: it only trips on genuinely unacked bytes, so a slow-but-alive server (still ACKing at the TCP layer, just slow to emit output) never false-fires. Best-effort and platform-guarded (no-op off Linux/Android); keepalive stays the fallback.

Verification

• Round-tripped the raw option on Linux: set 20000 → GetRawSocketOption reads back 20000 (confirms option level IPPROTO_TCP=6, name TCP_USER_TIMEOUT=18, and native endianness are correct and the kernel accepts it).
• Core suite (198) passes; the real-socket reconnect tests exercise the new setup without error.
• Note: exercising the actual half-open timeout requires a real packet-drop partition, which isn't unit-testable here — the option is confirmed applied and the mechanism is standard.

Builds on the connection-resilience work; the Disconnect button remains the manual escape hatch.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR improves connection resilience by proactively detecting half-open TCP connections: it applies TCP_USER_TIMEOUT (Linux/Android) so unacknowledged in-flight data fails fast, allowing the existing read-loop monitor to trigger auto-reconnect rather than hanging for extended OS-level retransmission timeouts.

Changes:

• Add a Linux/Android-only TCP_USER_TIMEOUT socket option setter (TrySetTcpUserTimeout) with best-effort behavior.
• Apply TCP_USER_TIMEOUT during connection establishment alongside existing keepalive tuning.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[HarryCordewener]

Verified: the 20s aligns with the reconnect schedule

Because TCP_USER_TIMEOUT is set before connect(), it bounds two things, not just established-connection death:

1. A dead established connection (unacked sent data) → socket fails at ~20s.
2. Each reconnect attempt's connect() → tested a connect to a blackhole address (RFC-5737 192.0.2.1): it fails at exactly 20.0s instead of the OS default (~130s of SYN retries).

So the recovery timeline stays predictable:

command sent → (unacked) → ~20s → socket fails → read loop ends → Reconnecting
  → wait 1s → connect (≤20s) → wait 2s → connect (≤20s) → … (backoff caps at 30s)

Every attempt is ≤20s connect + its backoff delay, and since 20s < the 30s max backoff, attempts never outrun the cadence or hang indefinitely on a still-down network. Without the option, each failed attempt would hang ~130s and the 60-attempt budget would balloon to hours.

Note: the earlier SO_KEEPALIVE tuning (~60s) is now effectively a cross-platform fallback — on Linux/Android TCP_USER_TIMEOUT (20s) overrides keepalive teardown; keepalive only drives timing on the Windows/macOS heads where this option is skipped. 20s is the single knob for both detection and per-attempt connect latency.

[HarryCordewener]

Added: header control now toggles Disconnect ⇄ Connect

Per request, the session-header control is now a toggle instead of Disconnect-only:

• Disconnect while Connected / Connecting / Reconnecting.
• Connect (reconnect to the last endpoint, in place) once the session is Disconnected or Error — no need to go back to the world list.

New ReconnectAsync() on TelnetConnection/ISession/Session is the user-initiated reconnect: it reconnects to the last endpoint even after an intentional DisconnectAsync (distinct from ForceReconnectAsync, the automatic network-change path, which stays a no-op after an intentional disconnect). SessionsViewModel gains CanConnect + ReconnectAsync(); the header renders the right button by state.

Adds SessionReconnectDelegatesToConnection; Core 199 / UI 47 pass, Web builds clean. (I tried to grab a before/after screenshot of the toggle, but the live server rate-limited my repeated test connects, so I'm relying on the unit tests + build here.)