Phase 2 sub-commit 3: full Update Semantics + ReactiveListModel + AppShell

BackendConnection's ConnectionState enum is now Connecting / Online /
Reconnecting / Offline (PLAN.md §5). The probe loop tracks the first
failure since the last Online and transitions to Reconnecting on any
failed probe, then to Offline once the configurable threshold (30 s
default) is exceeded. The Error state is gone; Reconnecting + the
exposed `error` string subsume its UI role.

ReactiveListModel is the headline QML type:

- QAbstractListModel that GETs `baseUrl + source` for an initial JSON
  array and then keeps in sync via an internal MercureClient subscribed
  to `topic`.
- Role names are derived dynamically from the first row's keys plus an
  internal `pending` boolean role used by optimistic mutations.
- Diff application: upsert (insert-or-update), delete, replace; gap
  detection via the envelope `version` field with auto re-fetch.
- `invoke(method, path, body, optimistic)` is the optimistic command
  primitive. Generates an Idempotency-Key, applies the local diff,
  POST/PATCH/DELETEs with that key, and resolves on the matching
  Mercure echo (correlation-key matched in ModelPublisher's envelope).
  Rolls back and emits commandFailed on 4xx/5xx, commandTimedOut after
  10 s without an echo. Phase 4 packaging will surface configuration
  for the timeout.

AppShell.qml is the optional convenience root:

- Reads BackendConnection.connectionState.
- Reconnecting → top banner.
- Offline → modal overlay with the error string and a Retry button
  (calls BackendConnection.restart()).
- Wraps user content via `default property alias content`.

Apps that want full chrome control can skip AppShell entirely; the
skeleton's Main.qml keeps its own status display for demonstration
and is unaffected.

ReactiveObject (single-entity twin of ReactiveListModel) is intentionally
deferred — same envelope handling, smaller surface; will land in Phase 2
follow-up or Phase 3 alongside the todo example. Cursor pagination is
similarly deferred (the Phase 2 done criterion uses small lists).

Smoke tested: /healthz + /api/ping round-trip cleanly, zero Mercure 401s,
clean shutdown. composer quality stays green (16 tests, 45 assertions).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

framework/qml/src/BackendConnection.cpp

@@ -73,18 +73,35 @@ void BackendConnection::onProbeFinished()
     if (!reply) return;
     reply->deleteLater();
 
+    bool ok = false;
     if (reply->error() == QNetworkReply::NoError) {
         const int status = reply->attribute(QNetworkRequest::HttpStatusCodeAttribute).toInt();
         if (status == 200) {
-            setError(QString());
-            setState(ConnectionState::Online);
-            return;
+            ok = true;
+        } else {
+            setError(QStringLiteral("/healthz returned HTTP %1").arg(status));
         }
-        setError(QStringLiteral("/healthz returned HTTP %1").arg(status));
     } else {
         setError(reply->errorString());
     }
-    setState(ConnectionState::Error);
+
+    if (ok) {
+        setError(QString());
+        m_firstFailureSinceOnline.invalidate();
+        setState(ConnectionState::Online);
+        return;
+    }
+
+    // Probe failed. Decide between Reconnecting and Offline based on how
+    // long we've been failing since the last Online. (PLAN.md §5.)
+    if (!m_firstFailureSinceOnline.isValid()) {
+        m_firstFailureSinceOnline.start();
+    }
+    if (m_firstFailureSinceOnline.hasExpired(m_offlineThresholdMs)) {
+        setState(ConnectionState::Offline);
+    } else {
+        setState(ConnectionState::Reconnecting);
+    }
 }
 
 void BackendConnection::setState(ConnectionState s)