fix(bedtime): bounded fallback window, fresh-screen access check

Without exact-alarm access the slot falls back to a ten-minute window
instead of plain set(), whose slack could end an eight-hour night hours
late. A freshly opened bedtime screen reads whether bedtime is on from the
store, not from its still-loading state, so access granted while the
screen was closed creates the rule. A restore that rolled back no longer
forces the mode.

Refs #1

docs/ARCHITECTURE.md

@@ -2759,7 +2759,8 @@ engines (`ArchitectureRulesTest` holds it to no `android.*` import):
 - `BedtimeScheduler`, **one** AlarmManager slot of its own. Its PendingIntent
   targets `BedtimeReceiver` with its own action and request code, so arming or
   cancelling it cannot replace or cancel an alarm's or a timer's registration.
-  It is `RTC_WAKEUP` and `setExact` (plain `set` without exact-alarm access),
+  It is `RTC_WAKEUP` and `setExact` (a ten-minute `setWindow` without
+  exact-alarm access, since plain `set`'s slack grows with the distance),
   and deliberately **not** allow-while-idle: Android rations allow-while-idle
   wake-ups per app in doze (one per nine minutes on Android 10 and 11, and for
   the inexact fallback without exact-alarm access), and the timer's expiry slot