fix(alarms): measure every ring against one window rule

Second round of review fixes for the silence-after setting.

A fire now clears any stale ringingSince before it re-resolves the slot.
Before, the resolver's new one-shot close could switch off, or delete, the
very alarm that was about to ring.

A one-shot alarm displaced by another alarm's fire is switched off, as on
every other close of an undismissed cycle, instead of being armed for the
same time tomorrow.

onAutoSilence, onSilenceAfterChanged and the reboot resume now share one
rule. A ring still inside the window has its backstop re-armed, measured
from when it started, or from now if the clock has moved back behind that
start, so a clock change cannot stretch a ring past one window.

Refs #17

docs/ARCHITECTURE.md

@@ -1229,7 +1229,9 @@ genuinely ringing alarm sounding with its backstop intact.
 **At most one alarm rings, and a newly-firing alarm takes over.** Two ringtones
 at once is not a feature, and queueing invents a state machine nobody can debug
 at 07:00. The alarm that is displaced keeps its watermark, so it does not come
-back the moment the slot is re-resolved.
+back the moment the slot is re-resolved. Its cycle has closed undismissed, so a
+displaced one-shot alarm is switched off (or deleted, if transient), as on
+every other close.
 
 `snoozeLimit == 0` means **snoozing is disabled**, not unlimited; v1 offers no
 unlimited, and "0 means infinite" is a trap. A refused snooze *dismisses*; it