fix(connectivity): stop spurious 'Wallet is offline' banners on intermittent connections

[islandbitcoin]

Problem

Users intermittently see "Wallet is offline" on the home screen when no deploy is happening and the backend is healthy. Two client-side causes:

1. NetInfo's default reachability probe hits clients3.google.com/generate_204. On networks where that endpoint is slow or filtered, isInternetReachable flips to false and the banner shows — even though the Flash API is perfectly reachable.
2. Firebase App Check attested on every GraphQL request. The appCheckLink ran initializeAppCheck() + getToken(true) (force refresh) per call, adding a full attestation round-trip to every query — slow, and a frequent source of "Network request failed".

Changes

• Probe our own API for reachability — NetInfo.configure sends a GET to galoyInstance.graphqlUri; only the wallet API's own 400-to-bare-GET signature counts as reachable, so a captive portal's 200/30x reads as unreachable (the protection the google-204 probe provided, kept). Configured exactly once per JS session, before any subscriber mounts — NetInfo.configure() tears down the library's shared state and orphans every mounted listener, so it must never re-run (it previously sat in the client effect that re-runs on token change).
• App Check initializes once (the init promise is memoized synchronously, so parallel cold-start operations share one attestation) and uses the SDK's cached auto-refreshing token (getToken(false)).
• New useConnectivity hook with an 8s offline debounce — deliberately longer than one full failed-probe cycle (reachabilityShortTimeout 5s + probe RTT; the constants are cross-referenced in both files and the coupling is test-enforced), so a single failed probe (one 502 during a deploy, a killed socket on foreground) never flashes the banner. justReconnected pulses only on the confirmed (true) edge of NetInfo's real false→null→true recovery sequence.
• Home screen silently refetches on reconnect — balances/transactions recover without pull-to-refresh; refetch rejections on the still-shaky edge are swallowed.
• Only transport-level failures are folded into the banner — ServerError/ServerParseError (non-2xx, carry statusCode) keep displaying, so a backend incident the probe can't see is never hidden.
• Localized copy: HomeScreen.offlineShowingCached ("No connection — showing cached balances"), en + all 23 locales.

Testing

• __tests__/hooks/use-connectivity.spec.tsx — 10 tests, all timings derived from the exported OFFLINE_DEBOUNCE_MS: single-failed-probe-cycle absorption (asserts the constant coupling), debounce boundary, confirmed-edge pulse (false→null→true), failed-probe re-latch (false→null→false), blip-after-real-offline (kills the stale-latch mutant found by mutation testing), flapping restart, exactly-one-pulse-per-offline-period.
• __tests__/hooks/use-device-token.spec.ts — 4 tests: init-once with isTokenAutoRefreshEnabled: true asserted, overlapping-calls-during-init (kills the memoize-after-await mutant), init-failure retry, transient token failure keeps the singleton.
• Full suite: 39 suites / 175 tests green; yarn tsc:check clean; changed files lint clean; translation-drift clean.
• Hardened by 3 rounds of multi-agent adversarial review (findings verified against the vendored NetInfo 11.5.2 source and by empirically running test mutants); round 3 returned zero confirmed findings.
• Manual: toggle airplane mode — banner appears only after ~8s offline, clears immediately on reconnect, home refreshes silently at the confirmed edge.

Notes

First step toward full offline capability. Follow-ups: getErrorMessages still carries a now-unreachable "Wallet is offline" mapping (pre-existing); cache persistor trimming and an offline mutation queue are the next milestones. A dev-screen instance switch retargets the probe only after an app reload (documented in client.tsx).

🤖 Generated with Claude Code