feat(gateway): power the motors down after 1 h idle, with a re-zero wizard

[BernardJen]

Closes #81.

What this is

The steppers were energized around the clock. They are now de-energized ($MD) after a
configurable idle period — default 1 hour, 0 to never — and because freeing the gantry on a
machine with no limit switches also loses the work origin, the daemon now says so, refuses the
motion that depends on it, and walks the operator back through setting it.

Both halves are here on purpose. Auto-off without the trust handling is worse than leaving the
motors on: the daemon would keep persisting a position recorded after the gantry was free and hand
it to G10 L20 as the work origin on the next connect, with soft limits disabled per-axis and
nothing downstream to stop the plot.

How it works

• src/grbl/motorPower.ts — the two rules as pure functions: shouldDropMotors (the timer vs
  the busy predicate) and reduceMotorPower (the trust state machine), plus canRestorePosition.
  Inside the coverage floor, and where all the branches are. 27 tests.
• The timer reuses isPlotting(), not a second predicate. It already encodes inflight,
  queued, isPaused, penChange !== null, Run and Hold — and the pen-change hold is the
  case that matters: deliberately Idle with an empty queue, exempt from the UI's stall watchdog,
  and very much mid-job. Dropping the motors there would land the rest of the drawing offset on a
  half-finished sheet that cannot be restarted.
• The activity clock counts motion commands and Run/Jog status, not every command. A
  browser autosaving its session every couple of seconds must not hold the steppers on forever.
• The saved state file carries trusted. A power-down writes trusted: false synchronously
  (fsync + rename), and restoreSavedPosition refuses such a file instead of reinstating it. That
  is what gives this a restart story without controller-side support. A file written by an older
  daemon has no flag and is still restored — no machine loses its remembered home to the upgrade.
• The gate is in the gateway, next to the command handlers, so a second tab cannot believe the
  origin is fine. Plot and Go to home are refused with the reason. Jog stays allowed — the operator
  needs it to reach the corner; the motion is fine, the coordinates are fiction. Stop still stops:
  while untrusted it runs the abort without stopAndReturnHome's rapid to an origin nobody believes.
• src/ui/RezeroWizard.tsx, modelled on the registration wizard: what happened → push or jog to
  the paper's top-left corner (with the motors' actual state spelled out) → Set home, which is the
  same setWorkZero() call Calibrate makes. Opens on the transition and from the Home/calibration
  panel; a banner holds the state until it is cleared.

The open question in the issue, answered

Daemon-driven $MD, not FluidNC's controller-side idle disable. FluidNC documents
$Motor/Disable / $MD and no $ME, and its status report carries no motor-enable field — so a
controller-side dropout is one the daemon cannot detect, which is precisely the half that makes
this safe rather than dangerous. Nothing new is sent to re-energize either: the motors come back
with the first move, the wizard says so, and confirming it is a hardware task
(FluidNC commands and settings).

Not done, deliberately

• No session-scoped "keep motors on" toggle. The issue lists it as a consider; 0 = never in
  Settings covers the same need with one mechanism instead of two.
• A ~200 ms window after Set home in which a daemon crash could persist a stale position: I
  narrowed it by setting lastWpos to 0,0,0 after G10 L20 P1 X0 Y0 Z0 (true by construction),
  which is the honest half of the fix. Closing it entirely means synthesising a WCO from a 5 Hz
  status, which is exactly the kind of position-restore cleverness that has passed review here and
  failed on the Pi. Not worth it for a window that already existed.
• Hardware verification. Per AGENTS.md, the ⚙ HARDWARE tasks in
  openspec/changes/idle-motor-power-down/tasks.md are left unchecked and the change is not
  archived. Four of them: the drivers audibly dropping out, the gantry genuinely free, the motors
  re-energizing on the first move, and a pen-change hold outlasting the idle period without losing
  register.

Verified

mise run ci green. Coverage up on every metric (branches 72.91% → 73.62%). Verified in the
browser: the banner, the disabled Plot / Go to home with the reason in their titles, both wizard
steps, and the Settings field.

Spec

openspec/changes/idle-motor-power-down/ — adds the motor-power capability, modifies
work-coordinates, gateway-protocol and app-settings.

🤖 Generated with Claude Code