fix(alarms): let the backstop always close the ring it was armed for

Fourth round of review fixes for the silence-after setting.

onAutoSilence no longer re-arms a ring it measures as inside the window.
After a clock moved back, that check could push the backstop out again
and stretch the ring well past its window. Every writer of the window and
every clock change already re-arms the backstop under the engine lock, so
a backstop that fires has had its window, and it closes the ring as in v1.

A one-shot alarm the resolver switches off as missed also clears a
pending skip flag, as the resolver's other one-shot disable does.
SNOOZE_GRACE is its own ten-minute constant again, not tied to the
setting's default.

Refs #17

docs/ARCHITECTURE.md

@@ -1183,13 +1183,14 @@ Changing the setting mid-ring applies at once. The settings screen writes it
 through `AlarmEngine.setAlarmSilenceAfter()`, which stores it and, under the
 same lock and uncancellably, measures the ring in progress against the new
 window from when it *started*: past it, the cycle closes as missed through
-`closeCycleLocked`; inside it, the backstop moves to the new end. As a second
-line, `onAutoSilence` re-arms rather than closes a ring that is still inside
-the current window, so a backstop armed for a shorter one can never end a ring
-early. A clock change re-measures the ring the same way before rescheduling:
-the backstop is a wall-clock registration, so a clock moved back re-arms it at
-most one window from the moved clock (and the backstop then closes the ring,
-its age still negative), and one moved forward past the window closes it.
+`closeCycleLocked`; inside it, the backstop moves to the new end. A clock
+change re-measures the ring the same way before rescheduling: the backstop is a
+wall-clock registration, so a clock moved back re-arms it at most one window
+from the moved clock, and one moved forward past the window closes it. When the
+backstop fires it always closes the ring, since every writer of the window and
+every clock change has already re-armed it for the window in force. A clock
+moved back mid-ring can still add up to the time already rung, which v1's fixed
+backstop did not bound at all.
 
 Whenever the resolver closes a ring (a clock jumped forward, a ringing alarm
 switched off, a reboot outlasting the window), `persist` stops the ring service