Once a quit starts, the app sets `quitting`, hides its windows and waits
for shutdown. If that shutdown never finishes, every later Quit and
SIGTERM was swallowed, so only SIGKILL could end the app.

Now a Quit or SIGTERM that arrives after shutdown has been pending for
10 seconds exits the app. A repeat inside that window is ignored as
before, so a double Cmd-Q during a normal quit cannot orphan the backend.

Refs #23843

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>