Polish runtime stop, scan, and accessibility states

[poulcarlsen53]

What changed

This PR smooths out a few app-state and UI edges that are easy to hit during normal use:

• proxy and VPN services now emit an explicit stopped event when they are stopped from the foreground notification or QS tile, so the open app can immediately leave the connected/connecting state instead of waiting for the next refresh
• VPN startup cleanup no longer reports a user-visible stop for the new session before it has actually started
• scan resume now marks the scan completed when there are no remaining resolvers to process, clears stale worker failures, and keeps the progress count consistent
• long-running scans now publish a heartbeat while worker output is quiet, which avoids the UI treating an active scan as stale
• compact controls get larger touch targets, text fields expose their visible labels to accessibility services, and decorative dropdown arrows are no longer announced as separate controls

Why

The previous runtime store was updated when a service stopped, but the live ViewModel only listened for log/ready/failed events. If a user stopped the connection from Android's notification action or QS tile while the app was open, the UI could keep showing a live connection.

The scanner had a similar lifecycle rough edge: quiet worker periods could leave the last state timestamp old enough to look stale, and resuming a fully processed scan kept the previous stopped/failed status even though there was no work left.

The accessibility changes are intentionally small and local. They keep the visual style compact, but give tap targets and screen-reader labels a bit more room to behave well with larger text and assistive tech.

Validation

• ./gradlew.bat :app:testDebugUnitTest --tests shop.whitedns.client.proxy.WhiteDnsProxyEventsTest --tests shop.whitedns.client.vpn.WhiteDnsVpnEventsTest --tests shop.whitedns.client.model.WhiteDnsModelsTest.completeResumeWithoutRemainingResolversMarksScanCompleted --tests shop.whitedns.client.scan.WhiteDnsScanServiceTest --no-daemon
• ./gradlew.bat :app:assembleDebug --no-daemon

I kept the validation focused here because the full Windows unit-test run still trips over the existing scan resolver line-ending issue that is handled separately.