android-emulator: sleep after 6h idle (activity-based), fix never-sleeping

The emulator was meant to scale to zero when idle but had been up 6+ days
straight despite ~5 days with no real use. Two bugs:

1. The idle check counted ESTABLISHED TCP connections to the adb/noVNC
   ports. A forgotten `adb connect` (no disconnect) holds that transport
   open forever, so every 15-min run saw "active" and reset the counter --
   it never reached the sleep branch. (Right now: 4 such stale transports
   from pods on k8s-node3/node4.)
2. Even when it did reach the sleep branch, `kubectl scale --replicas=0`
   failed Forbidden -- the gate ServiceAccount can patch `deployments` but
   not `deployments/scale`.

Switch the sleeper to measure actual use: time since last user activity
(taps/keys/app-launches, incl. noVNC clicks) from `dumpsys power` vs guest
uptime. No interaction for 6h -> sleep. This ignores idle/forgotten
connections entirely. Scale down with a direct replicas patch on the named
deployment (same path the wake gate scales up), so it needs only the
existing `deployments` patch grant -- no `deployments/scale`. Now stateless
(drops the idle-counter annotation; gate.py no longer sets it) and lighter
on etcd. Fail-safe: any read error (e.g. mid-boot) does not sleep.

Requested by Viktor: turn the dev-only emulator off when it hasn't been
used for 6h.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

stacks/android-emulator/README.md

@@ -6,9 +6,12 @@ tenant: tripit). Decision record: `docs/adr/0001-android-emulator-in-cluster.md`
 
 ## On-demand lifecycle (since 2026-06-12)
 
-The emulator **scales to zero when idle** (no adb/VNC connections for ~1h,
-checked by the `android-emulator-idle-sleeper` CronJob) and **wakes on
-visit**: the wake gate owns `/` on both hostnames. Warm boot is ~90s.
+The emulator **scales to zero when idle** (no user interaction for 6h —
+taps/keys/app-launches/noVNC clicks, read from `dumpsys power` by the
+`android-emulator-idle-sleeper` CronJob) and **wakes on visit**: the wake
+gate owns `/` on both hostnames. Warm boot is ~90s. Idle is measured from
+real interaction, not connection count, so a forgotten `adb connect` (left
+ESTABLISHED) no longer keeps it awake — but `adb disconnect` anyway.
 
 - Humans: open https://android-emulator.viktorbarzin.me — it wakes the
   emulator if needed, shows a self-refreshing boot page, then hands over to