fix(ptz): stop-on-loss — ONVIF dead-man's-switch + VISCA halt-on-reconnect

[TCVinNYC]

What / Why

A PTZ camera must not run away when its connection drops. This PR adds two backend-local safety mechanisms:

ONVIF dead-man's switch (onvif_ptz.py)

• Sets Timeout=timedelta(seconds=1) on every ContinuousMove request so the camera self-stops if no new command arrives within ~1 s (connection loss, hung network). Uses Python datetime.timedelta which zeep accepts directly.
• Wraps move_velocity in try/except with a throttled WARNING (one per 5 s) so a sustained transport outage logs once and never crashes the control loop.
• stop() already had a bare except Exception: pass; unchanged.

VISCA halt-on-reconnect (visca_ip.py, visca_usb.py)

• After a successful reconnect inside _send, always sends pantilt-stop + zoom-stop before retrying the pending command. A camera that was mid-pan when the link dropped halts rather than continuing a stale continuous-move. Sending stop to an already-stopped camera is a safe no-op.
• No changes to reconnect.py or base.py; no changes to camera_worker.py / controller.py (those get the complementary heartbeat in a later PR).

Tests

12 new tests in tests/test_ptz_stop_on_loss.py:

• ONVIF: Timeout field present and correct value; velocity fields intact; transport errors caught (move + stop); log throttle
• VISCA IP: stop before move on reconnect (mid-move and already-stopped cases); ordering assertion
• VISCA USB: same three tests for serial backend

No real hardware/network — all transports mocked (same style as test_ptz_reconnect.py).

Gate results

ruff check   — ✓ all checks passed
ruff format  — ✓ 4 files already formatted
mypy         — ✓ no issues (11 source files)
pytest       — ✓ 1218 passed in 30.62s
selftest     — ✓ all checks passed

🤖 Generated with Claude Code