read the gamepad from dora-joy and publish twist and command

The pad moves to dora-joy, so this node keeps no hardware dependency and the
pad becomes reusable. It arrives on `joy` as a plain reading; `JoyInput.read`
treats silence past JOY_TTL_S as absence, because that node dying looks like
silence rather than like an unplugged pad and the arm cannot tell them apart.

Both control sources are now normalised to a [-1, 1] six-vector before anything
is scaled, and the scaling happens in one function. The web path used to pass a
velocity straight through without going near mapping, which is why the console
had to speak the arm's units. It no longer does.

`twist` (SI) and `command` (robot-agnostic verbs) are the standard ports. `jog`
and `request` still carry the same intent in dora-ulite6's units and service
names so the two repositories can move independently; LEGACY_REQUEST is the
only place that knows what that node calls a verb. Wire one or the other, never
both. `joint_jog` is specified in the manifest and deliberately not built.

Schemas are declared rather than inferred: pyarrow reads a null `value` as its
own type, so an inferred `command` would change its port's type between one
verb and the next.

Three bugs found while moving this code, each with a test:

- `Sample.active` compared raw axes against a threshold, but SDL rests a
  trigger at -1.0, so every connected pad read as in use for ever: the pad took
  the lease on plug-in and GAMEPAD_IDLE_RELEASE_S never fired.
- The e-stop latch was never consulted when deciding a velocity, so Back
  stopped the arm for one tick and the next stick nudge drove it again. Nothing
  on the pad could clear it either. It is now checked above the lease, and X
  releases it and clears the controller's error, as the console's RESET does.
- Buttons were read before the arbiter granted the lease, so the first press
  after the pad had been idle was swallowed: not owned yet when read, and no
  longer a rising edge by the next tick.

dora_teleop/config.py

@@ -20,31 +20,27 @@ def env_float(name: str, default: float) -> float:
         raise ValueError(f"{name} must be a number, not {value!r}") from None
 
 
-def env_int(name: str, default: int) -> int:
-    """Read a whole number, naming the variable if it cannot be read as one."""
-    value = os.environ.get(name, "").strip()
-    if not value:
-        return default
-    try:
-        return int(value)
-    except ValueError:
-        raise ValueError(f"{name} must be a whole number, not {value!r}") from None
-
-
 @dataclass
 class DeadmanConfig:
     """How long a source may go quiet before the arm is told to stop.
 
-    Three layers, outermost last. This node re-sends the current velocity every
-    tick; `jog_ttl_s` is how long it will keep doing so without hearing from the
-    source; and behind both sits the arm node's own `VELOCITY_COMMAND_TTL_S`,
-    which the controller enforces whether or not this process is alive.
+    Four layers, outermost last. `joy_ttl_s` is how long a pad reading stays
+    worth acting on; this node re-sends the current velocity every tick;
+    `jog_ttl_s` is how long it will keep doing so without hearing from the
+    source; and behind all of them sits the arm node's own
+    `VELOCITY_COMMAND_TTL_S`, which the controller enforces whether or not this
+    process is alive.
 
-    Keep them in that order — ours shorter than the controller's — or the
+    Keep them in that order — each shorter than the one behind it — or a
     backstop fires before the thing it is backing up.
     """
 
     jog_ttl_s: float = 0.4
+    # How long the `joy` stream may go quiet before the pad reads as gone. The
+    # pad lives in another node now, and that node dying looks like silence
+    # rather than like an unplugged pad, so silence has to mean the same thing.
+    # `dora-joy` publishes every tick, so it means nothing else.
+    joy_ttl_s: float = 0.2
     # How long a gamepad may sit untouched before it gives the arm back, so the
     # browser can take over without anyone having to press anything.
     gamepad_idle_release_s: float = 2.0
@@ -57,6 +53,7 @@ class DeadmanConfig:
         """Build the timings from the environment."""
         return cls(
             jog_ttl_s=env_float("JOG_TTL_S", 0.4),
+            joy_ttl_s=env_float("JOY_TTL_S", 0.2),
             gamepad_idle_release_s=env_float("GAMEPAD_IDLE_RELEASE_S", 2.0),
             state_poll_s=env_float("STATE_POLL_S", 0.5),
         )
@@ -77,7 +74,6 @@ class Config:
     # How much of the curve is cubic: 0 is linear, 1 is fully cubic. Fine
     # positioning happens near centre, and expo is what buys resolution there.
     expo: float
-    joystick_index: int
     deadman: DeadmanConfig = field(default_factory=DeadmanConfig)
 
     @classmethod
@@ -89,11 +85,18 @@ class Config:
         expo = env_float("EXPO", 0.4)
         if not 0.0 <= expo <= 1.0:
             raise ValueError(f"EXPO must be between 0 and 1, not {expo}")
+        deadman = DeadmanConfig.from_env()
+        # The layers have to fire outermost last, and each one is a backstop for
+        # the one inside it. Behind both of these sits the arm node's own
+        # VELOCITY_COMMAND_TTL_S, which no setting here can see.
+        if deadman.joy_ttl_s >= deadman.jog_ttl_s:
+            raise ValueError(
+                f"JOY_TTL_S must be below JOG_TTL_S ({deadman.jog_ttl_s}), not {deadman.joy_ttl_s}"
+            )
         return cls(
             speed_mm_s=env_float("SPEED_MM_S", 60.0),
             speed_deg_s=env_float("SPEED_DEG_S", 30.0),
             deadzone=deadzone,
             expo=expo,
-            joystick_index=env_int("JOYSTICK_INDEX", 0),
-            deadman=DeadmanConfig.from_env(),
+            deadman=deadman,
         )