Show indexer-unreachable popup instead of silent failure (#971)

[dangershony]

Summary

Implements issue #971, with a deliberate design change agreed with the maintainer: no automatic fallback. When the currently selected primary indexer fails to respond, the app shows a picker popup directly instead of silently retrying other configured indexers.

Scoped to \src/design/App\ (the new Avalonia rewrite) plus the shared/SDK plumbing it depends on, per repo conventions. \src/webapp\ and \src/avalonia\ (dead code) are untouched.

Changes

Shared layer (\src/shared/Angor.Shared)

• New \IndexerUnreachableEventArgs\ model.
• \INetworkService/\NetworkService: added an \IndexerUnreachable\ event and \NotifyIndexerUnreachable(url, reason)\ method. Marks the indexer offline in storage and raises the event, debounced (20s) per indexer URL so a burst of concurrent failing requests doesn't flood subscribers.
• \MempoolSpaceIndexerApi: every failure path (timeout/exception, or a non-success HTTP response) now calls \NotifyIndexerUnreachable\ before throwing/returning. No attempt is made to silently retry against a different indexer.
• Updated \TestNetworkService\ test double to implement the new interface members.

App layer (\src/design/App)

• New \IndexerUnreachableModalViewModel\ + \IndexerUnreachableModal\ view, following the existing \ModalCard\ sizing convention and the \WalletSwitcherModal\ pattern. Lists all configured indexers with status, lets the user pick one to use as primary, or add a custom URL.
• \ShellViewModel\ subscribes to \INetworkService.IndexerUnreachable\ and shows this modal directly via \ShowModal(...), guarded so only one popup is shown at a time.

Testing

• \dotnet build\ clean on \Angor.Shared, \Angor.Sdk.Tests, \App, \App.Desktop.
• \dotnet test src/sdk/Angor.Sdk.Tests: 349 passed, 0 failed.
• \dotnet test src/shared/Angor.Shared.Tests: 160 passed, 0 failed.
• \dotnet test src/design/App.Test.Integration --filter FullyQualifiedName~LayoutRegression: 187 passed, 0 failed (confirms the shell/modal changes don't break any view layout).

Follow-ups (not included in this PR)

• A dedicated UAT test exercising an actual unreachable indexer end-to-end.
• A \LayoutRegression\ entry specifically for the new modal.

Closes #971