Phase 2 sub-commit 3: full Update Semantics + ReactiveListModel + AppShell

BackendConnection's ConnectionState enum is now Connecting / Online /
Reconnecting / Offline (PLAN.md §5). The probe loop tracks the first
failure since the last Online and transitions to Reconnecting on any
failed probe, then to Offline once the configurable threshold (30 s
default) is exceeded. The Error state is gone; Reconnecting + the
exposed `error` string subsume its UI role.

ReactiveListModel is the headline QML type:

- QAbstractListModel that GETs `baseUrl + source` for an initial JSON
  array and then keeps in sync via an internal MercureClient subscribed
  to `topic`.
- Role names are derived dynamically from the first row's keys plus an
  internal `pending` boolean role used by optimistic mutations.
- Diff application: upsert (insert-or-update), delete, replace; gap
  detection via the envelope `version` field with auto re-fetch.
- `invoke(method, path, body, optimistic)` is the optimistic command
  primitive. Generates an Idempotency-Key, applies the local diff,
  POST/PATCH/DELETEs with that key, and resolves on the matching
  Mercure echo (correlation-key matched in ModelPublisher's envelope).
  Rolls back and emits commandFailed on 4xx/5xx, commandTimedOut after
  10 s without an echo. Phase 4 packaging will surface configuration
  for the timeout.

AppShell.qml is the optional convenience root:

- Reads BackendConnection.connectionState.
- Reconnecting → top banner.
- Offline → modal overlay with the error string and a Retry button
  (calls BackendConnection.restart()).
- Wraps user content via `default property alias content`.

Apps that want full chrome control can skip AppShell entirely; the
skeleton's Main.qml keeps its own status display for demonstration
and is unaffected.

ReactiveObject (single-entity twin of ReactiveListModel) is intentionally
deferred — same envelope handling, smaller surface; will land in Phase 2
follow-up or Phase 3 alongside the todo example. Cursor pagination is
similarly deferred (the Phase 2 done criterion uses small lists).

Smoke tested: /healthz + /api/ping round-trip cleanly, zero Mercure 401s,
clean shutdown. composer quality stays green (16 tests, 45 assertions).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

framework/skeleton/qml/Main.qml

@@ -63,9 +63,14 @@ ApplicationWindow {
 
             Rectangle {
                 Layout.preferredWidth: 12; Layout.preferredHeight: 12; radius: 6
-                color: BackendConnection.connectionState === BackendConnection.Online
-                       ? "#3ab36c"
-                       : (BackendConnection.connectionState === BackendConnection.Error ? "#d8503c" : "#d89614")
+                color: {
+                    switch (BackendConnection.connectionState) {
+                        case BackendConnection.Online:       return "#3ab36c"
+                        case BackendConnection.Reconnecting: return "#d89614"
+                        case BackendConnection.Offline:      return "#d8503c"
+                        default:                             return "#888"
+                    }
+                }
             }
             Label { text: "Backend: " + window._stateName(BackendConnection.connectionState) }
 
@@ -123,9 +128,10 @@ ApplicationWindow {
 
     function _stateName(s) {
         switch (s) {
-            case BackendConnection.Connecting: return "connecting"
-            case BackendConnection.Online:     return "online"
-            case BackendConnection.Error:      return "error"
+            case BackendConnection.Connecting:    return "connecting"
+            case BackendConnection.Online:        return "online"
+            case BackendConnection.Reconnecting:  return "reconnecting"
+            case BackendConnection.Offline:       return "offline"
         }
         return "?"
     }