fix(deck): swallow HID errors in refresh() after disconnect

[Faerkeren]

Problem

Running examples/streamdeck.py and unplugging the Stream Deck while the ClockController tick loop is active produces an unhandled task exception:

WARNING: Deck disconnected: A00WA4221NAA3I -- waiting for reconnect...
ERROR: Task exception was never retrieved
future: <Task finished name='clock-tick' coro=<ClockController._tick_loop() ...>
    exception=HidApiError('Device is not open')>
Traceback (most recent call last):
  File "examples/streamdeck.py", line 1062, in _tick_loop
    await self.key.request_refresh()
  ...
  File "src/deux/runtime/hid/device.py", line 211, in _ensure_open
    raise HidApiError("Device is not open")

Root cause

Background tasks (clock ticks, spinners, timers) call KeySlot.request_refresh() -> Deck.refresh() without knowing the deck's lifecycle. When DeckManager tears down the device after a disconnect, an in-flight refresh that has already been scheduled lands in _exec_device_io, where the executor calls device.set_key_image on a closed handle and raises a bare HidApiError from ctypes hidapi. That exception bubbles up to the user's tick task, which has no reasonable way to guard every call site.

Fix

Treat Deck.refresh() as best-effort: catch HidApiError and HidWriteTimeout from the per-control render+push stage and log at DEBUG. The manager's disconnect handler already emits a user-facing warning and re-attaches on reconnect, so silent recovery here is the right boundary.

Tests

• test_swallows_hidwritetimeout -- refresh tolerates a HidWriteTimeout from any push.
• test_swallows_hidapierror -- same for a bare HidApiError deeper in the stack.
• Full suite passes; coverage 95.62%.