[client] Enforce a file drop block on a transfer already in flight

The receiving policy was read once, in submitOffer, and never again. The
upload path and the reader guarding it both watched only the offer's own
Decision, so blocking a sender refused its next offer while the transfer it
had already started kept streaming into the spool and was delivered.

SetSenderRule tried to settle the sender's offers but went through Decide,
which only moves an offer out of Pending, and skipped everything else -
precisely the accepted ones that were still running. It now revokes any
non-terminal offer instead, and the staged copy re-reads the policy on the
same cadence it already checks the decision, so a block stops the bytes.

State.terminal carries the state list that Transfer.terminal duplicated.

client/internal/filedrop/protocol.go

@@ -201,3 +201,12 @@ func (s State) String() string {
 		return fmt.Sprintf("unknown(%d)", uint8(s))
 	}
 }
+
+func (s State) terminal() bool {
+	switch s {
+	case StateCompleted, StateDeclined, StateExpired, StateCancelled, StateFailed:
+		return true
+	default:
+		return false
+	}
+}