fix(session): alert on every unsolicited native stop, not just the deadline

Second review pass found that VpnStatus.error is unreachable mid-session:
AppConfigs.V2RAY_STATES has no error state and the plugin's stateName when()
ends in else -> "DISCONNECTED", so Dart's unknown -> error mapping is dead
code on Android. Every native stop therefore arrived as a plain disconnect,
and anything other than the expiry deadline - an Xray or TUN setup failure, a
mid-session fail-closed deadline arm - left the user on their real IP with no
notification and no message. That is the exact hole this feature exists to
close.

stopAll() is the single funnel for every native stop, so the alert moves
there: it fires when the stop interrupted a live tunnel and the user did not
ask for it. isRunning is captured before cleanup() clears it, which keeps a
failed connect silent - it never had a tunnel to interrupt. STOP_SERVICE
(the notification's Disconnect action) and onRevoke pass userRequested: in
the revoke case the user switched VPNs or withdrew consent themselves, and
may well be protected by the app that took over.

Also from the pass:
- re-arming now needs the deadline to move by more than 15 s, so round-trip
  jitter cannot cancel and re-post a warning that is already on screen
- a warning delivered with under a minute left is dropped rather than
  announcing "5 minutes"; the disconnected alert follows anyway
- the _doDisconnect comment no longer claims endedMessage posts the alert
- CHANGELOG: the alert does now cover the tunnel stopping unexpectedly

flutter analyze clean; debug APK builds with the Kotlin recompiled.

Co-Authored-By: Claude Opus 5 <[email protected]>

lib/logic/session_timer.dart

@@ -256,9 +256,10 @@ class SessionTimer extends ChangeNotifier with WidgetsBindingObserver {
   }
 
   // endedMessage is the one sentence the UI shows after an end the user did
-  // not ask for, and its presence is also what posts the "not protected"
-  // notification. Both exist so nobody is left on their real IP without being
-  // told. A user-requested disconnect passes nothing.
+  // not ask for; postAlert independently decides whether to raise the "not
+  // protected" notification, which the native service already posts for every
+  // stop it sees. Both exist so nobody is left on their real IP without being
+  // told. A user-requested disconnect passes neither.
   Future<void> _doDisconnect(
     String reason, {
     String? endedMessage,