(remote): keep descriptors on a failed refresh, let a manual refresh force reconnection

[devsuitup]

Closes #252.

Why

Measured on 2026-09-10 17:41, right after an app restart: the first inventory refresh hit an ssh connect timeout while the watch channel had opened 17 s earlier and probes right after answered in 0.5–7.6 s. On a failed refresh remote-index.js wiped the host's descriptors, so every remote session became non-attachable (click opened the transcript) for the whole 300 s backoff, while the tmux sessions were alive. The manual refresh could not help: refreshHostNow honoured the backoff, and the only way out was toggling the host in Settings.

What

• A failed refresh keeps the last known descriptors; only a successful inventory replaces them. The host dot already shows the error and the age of the last confirmed sync; its tooltip now adds the next automatic attempt.
• refreshNow({ force }) / refreshHostNow(alias, { force }) reset the backoff and run immediately; the automatic caller stays unforced.
• IPC remote-hosts-refresh is forced and restarts the watch channel per enabled host; new remote-host-refresh(alias) does it for one host. killChild already clears a pending restart timer, so a restart never double-spawns.
• Renderer: the sidebar refresh button also triggers the forced remote refresh (fire and forget); a reconnect button next to each remote host dot triggers it for that alias and flips the dot to remote-host-connecting until the next render.
• Context doc: backoff and freshness-contract sections updated.

Proof

Mutations on the shipped files: restore the wipe → "keeps the last known descriptors" test red; drop the force branch → forced-refresh test red, automatic-backoff test green.

task check: 1235 pass, 0 fail, 8 pre-existing skips.

Not covered by a test: the watch-channel restart inside the IPC handlers (main.js has no IPC harness).