fix: eight small fixes from an adversarial bug sweep

[MegaManSec]

Findings from a multi-agent review sweep (every finding independently re-traced against the code before fixing). One commit per concern; all are small and standalone.

• Pairing Discard race: pair()/unpair() ran unserialized on the global concurrent queue, so Discard during the ~0.5s PBKDF2 save deleted first and the save then resurrected the discarded code — the Mac stayed paired to a key the user threw away. Now serialized on one queue. Settings-open also re-reads pairing state, healing a transient keychain read failure that otherwise reads as "unpaired" all session.
• Hotkeys lost after abandoned recording: recording unregisters all hotkeys; closing Settings mid-recording never fired onDisappear (the window is ordered out, not torn down), leaving them unregistered all session. A willCloseNotification observer now cancels the recording.
• Refused dials misreported: a refused TCP connect parks NWConnection in .waiting and never reaches .failed, so it burned the 5s timeout and reported "didn't respond". Both dialers now fail fast on ECONNREFUSED.
• Wrong code reported as tampering: a mismatched pairing code fails AEAD-open before the MAC compare, so users saw "possible tampering" while the "codes don't match" message was unreachable. decryptionFailed now maps to the codes-don't-match message.
• Rate-limit blocks outlive a re-pair: inbound blocks (persisted, 15 min) recorded failures against the old key — typically the legit peer mid-typo — and survived fixing the code. The pairing fingerprint changing now resets the limiter.
• Type selectors break across handoffs: deviceClasses was rebuilt from the live paired snapshot, so a handed-off peripheral lost its Class of Device and type-based matching (menu icons, peripheral=<type> URL selectors) degraded to name-only exactly when a cross-Mac take needs it. Now persisted and merged. Plus an identity guard so a stale devicePairingFinished can't free a newer in-flight pair.
• Dropdown stale-row clicks: a store-driven rebuild during the press-tracking loop detaches the row; its action then fired with stale state. Detached rows now drop the click.
• Two small ones: a successful update check now clears the sticky "Couldn't check" flag, and the advertising self-check bumps its generation before any early return so an aborted restart can't produce a false "not advertising" warning.

Confirmed-but-deferred (need hardware testing, happy to file issues): connect-attempt bookkeeping lacks attempt identity (stale failures can clobber a newer attempt), wake reclaim with auto-reconnect off no-ops against sleep-released devices, and unregisterFromPC/disconnectPeripheral run blocking IOBluetooth calls on the main thread.

Not built in Xcode here, but swiftc -typecheck against the macOS SDK passes — please build before merging.

[github-actions]

🎉 This PR is included in version 2.25.3 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀