refactor(settings): read a silence-after of an hour or more as Never

A stored value of 60 minutes or more now reads as Never, which rings that
long anyway. The picker no longer shows both "60 minutes" and "Never" for
the same window. Also drops a redundant null check in TimerRingPolicy.

Refs #17

docs/ARCHITECTURE.md

@@ -1175,8 +1175,8 @@ from ringing until its battery is flat, what bounds the ring services' wake
 locks, and what keeps a reboot hours later from resuming a ring nobody was
 there for. So "Never" maps to `SilenceAfter.HARD_STOP` (60 minutes), longer
 than any finite choice, and the settings hint says so in words. Stored values
-go through `SilenceAfter.sanitise` on read, on write and from a backup: over 60
-is 60, so no value can make a ring outlast the hard stop, and a negative one is
+go through `SilenceAfter.sanitise` on read, on write and from a backup: 60 or more
+is "Never", so no value can make a ring outlast the hard stop, and a negative one is
 the default rather than the clamp's floor, which would be "Never".
 
 Changing the setting mid-ring applies at once. The settings screen writes it

docs/BACKUP.md

@@ -151,8 +151,8 @@ other unknown field.
 are how long a ringing alarm or a finished timer keeps going before it stops on
 its own: whole minutes, with `0` meaning "Never" (which still stops after an
 hour). A file without them, from before the setting existed, imports as `10`,
-the value it was made with. A value over 60 reads as 60 (which is what Never
-rings for anyway); a negative one reads as the default, 10.
+the value it was made with. A value of 60 or more reads as 0, "Never" (which
+rings for that long anyway); a negative one reads as the default, 10.
 
 Every numeric/duration value is clamped on *apply* using the same ranges and encoding
 as the existing preference setters, never on parse.