fix(ui): Admin's remote Reboot now confirms like Start OTA

Reboot fired on a single Enter with no way back, unlike Start OTA on
the same tab -- inconsistent given both take an unattended remote node
out of action for a while. Reuses the same beginConfirm() idiom.

docs/solo_features/tools_screen/tools_screen.md

@@ -576,7 +576,7 @@ Send commands to a **repeater/room server you have admin permission on** — the
    - **Name / Owner info** first **fetch** the node's current value, then open the keyboard **pre-filled** with it to edit — submitting sends the change. If the fetch fails or times out, the keyboard still opens (blank), so the value can be set blind.
    - **Radio and Routing rows** are typed, not free text: **Repeat** is an ON/OFF toggle; **Advert interval / Flood advert interval / Max hops / TX power** are number steppers (**LEFT/RIGHT** to adjust, within that field's valid range); **Frequency** uses the same digit-by-digit cursor editor as Settings' own Radio screen (**LEFT/RIGHT** moves between digits, **UP/DOWN** changes the selected one); **Bandwidth / Spreading factor / Coding rate** step through their valid discrete LoRa values with **LEFT/RIGHT**. All four Radio-tuple fields (Frequency/Bandwidth/SF/Coding rate) fetch and re-send the same underlying `radio` value together — editing any one of them still only overwrites that one, the other three round-trip unchanged. **Enter** sends the change; **Cancel** discards it and returns to the row list without sending anything.
    - **Admin password** has no fetch (there's no way to read a password back) — it opens straight to a blank keyboard.
-   - **Actions** (Reboot, Send advert, …) send immediately, no editing step — except **Start OTA**, which asks **Start / Cancel** first (defaulting to Cancel): it puts the remote into BLE DFU mode for the duration of the update, far more disruptive than a quick reboot.
+   - **Actions** (Send advert, Sync clock, …) send immediately, no editing step — except **Reboot** and **Start OTA**, which both ask first (defaulting to Cancel): they take the remote out of action for a while with no way to intervene on an unattended node if something goes wrong.
    - **Custom command...** (last row of Actions) opens the same free-text entry for anything not covered above — up to 160 characters, see the linked reference for the full grammar. The keyboard's **{}** key doubles as command completion here: it lists commands matching whatever's typed since the last space (narrowing as you type), and picking one completes that word instead of just inserting after it.
 4. **Read the reply** — the text reply opens in a scrollable view (**UP/DOWN** to scroll, **Cancel/Enter** to go back to the category tabs).
 

examples/companion_radio/ui-new/AdminScreen.h

@@ -138,11 +138,12 @@ class AdminScreen : public UIScreen {
   FullscreenMsgView _reply_view;
   char _reply_text[200] = "";
 
-  // "Start OTA" confirmation -- pulls the remote out of the mesh into BLE DFU
-  // mode for the duration of the update, far more disruptive than the other
-  // one-shot actions on this tab, so unlike Reboot it doesn't fire on a bare
-  // Enter. Only this one action needs a confirm today, so it's special-cased
-  // in activateField() by command string rather than adding a generic
+  // "Start OTA" and "Reboot" confirmation -- both take the remote out of
+  // action for a while (OTA into BLE DFU mode, reboot just offline for a
+  // few seconds) with no way to intervene if something goes wrong on an
+  // unattended node, unlike the other one-shot actions on this tab. Only
+  // these two need a confirm today, so they're special-cased in
+  // activateField() by command string rather than adding a generic
   // needs_confirm flag to every AdminField literal below.
   PopupMenu _confirm;
   const AdminField* _pending_confirm_field = nullptr;
@@ -241,6 +242,11 @@ class AdminScreen : public UIScreen {
         _confirm.beginConfirm("Start OTA update?", "Start");
         return;
       }
+      if (!strcmp(f.get_cmd, "reboot")) {                            // see _confirm's comment
+        _pending_confirm_field = &f;
+        _confirm.beginConfirm("Reboot node?", "Reboot");
+        return;
+      }
       strncpy(_cmd_text, f.get_cmd, sizeof(_cmd_text) - 1);
       _cmd_text[sizeof(_cmd_text) - 1] = '\0';
       sendCommand();
@@ -704,7 +710,7 @@ const AdminScreen::AdminField AdminScreen::ACTION_FIELDS[] = {
   { "Send advert",          "advert",         nullptr },
   { "Send zero-hop advert", "advert.zerohop", nullptr },
   { "Sync clock",           "clock sync",     nullptr },
-  { "Reboot",               "reboot",         nullptr },  // disruptive + no confirm: keep off the default row
+  { "Reboot",               "reboot",         nullptr },  // confirmed first -- see _confirm's comment
   { "Start OTA",            "start ota",      nullptr },  // confirmed first -- see _confirm's comment
   { "Custom command...",    nullptr,          nullptr },
 };

release-notes.md

@@ -23,6 +23,7 @@
 - **Hold Enter no longer doubles as a second Back key.** On Tools, Locator, Live Share, Repeater, Remote Bot, Auto-Advert, GPIO, Compass, the Dashboard config and the Messages navigate view it quietly meant "go back", while on other screens the same gesture opens a context menu — so the same long press did two unrelated things depending on where you were. It now only ever opens a menu (or does nothing where there is none), and Back is the single way back. This also applies inside an open popup, which Hold Enter used to dismiss — and, last of all, inside the on-screen keyboard: Hold Enter on Space, OK/Done or the `{}` placeholder cell used to close the keyboard exactly like Cancel; it's now a no-op there too, alongside its real jobs on Shift (caps-lock) and Backspace (clear field) and its accent popup on a Latin letter.
 - **Deleting a channel, deleting a saved radio preset, Trail's "Reset trail", and Diagnostics' "Reset counters" all fired immediately on a single Enter, with no way back.** Deleting a contact already asks first and defaults to Cancel; these four didn't, and Reset trail was the worst of them — it wipes the entire recorded GPS trail with no undo short of a prior manual Save, more destructive than the GPS-off prompt already sitting one menu over in the same screen. All four now confirm the same way contact-delete does.
 - **Tools › Repeater hid its Network mode, profile and every flood filter until the Repeater switch itself was turned ON**, so setting one up meant enabling it first, configuring blind, and only then seeing what you'd set — every other on/off tool (Bot, Live Share, Locator) already leaves its settings visible and editable while off. Repeater now does too.
+- **Tools › Admin's Reboot fired a remote node's reboot immediately on a single Enter, with no way back**, unlike Start OTA right next to it on the same tab, which already asks first — an unattended repeater you can't physically power-cycle deserves at least as much caution as a DFU update it will resume normal operation from either way. Reboot now confirms the same way.
 - **The one alert after a successful advert or message send didn't match the rest of the app's toasts.** `"Advert sent!"` / `"Advert failed.."` and `"Sent!"` were the only alerts anywhere with trailing punctuation; every other confirmation (`"Preset saved"`, `"Contact added"`, `"Target set"`, …) is bare. Also, unpinning something from the Favourites Dial reported which slot it came out of on some screens but not others — pinning always said so, unpinning only did from the Messages screens. Both now match the rest.
 
 ---