Phase 2a: PoweredOn await for scan/connect/work (FR-1.4, FR-8.6)

[itsniper]

Parent: #51

Requirements

• Replace silent scan no-op when not PoweredOn with await-until-ready and/or typed failure for terminal states (unauthorized, unsupported, powered off per policy).
• Connect and other work submission follow the same PoweredOn contract.
• Keep Bluetooth state stream for UI gating.

Acceptance criteria

• No silent no-op scan when radio not ready
• Terminal states surface typed errors
• Transient unknown/resetting can complete when PoweredOn arrives (or documented timeout)
• Tests cover ready wait + terminal failure