What changed

Fixes wear detection on AirPods Max 2. The app used to show "in-ear" all the time — even when the headphones were sitting on a desk — so auto play/pause never triggered. Now the dashboard reflects whether the headphones are actually being worn, and auto play/pause works as expected when both earcups come off.

Technical Context

• Root cause: Max 2 reused Max gen 1's BLE advertisement decoding, which reads bit 5 of the status byte. On A3454 bit 5 is always set while advertising; the actual ear-wear state is encoded in bits 1 and 3 (the per-earcup sensors). Reading bit 5 always returned true.
• The two earcup bits are OR'd into a single boolean. AND-ing would match macOS UX (one earcup off ⇒ pause) but breaks Android: phones without the L2CAP/AAP-derived keys only see one of the two bits reliably (the reporter observed 0x23 for "both worn" and 0x21 for "neither" — bit 1 only). AND would falsely report "not worn" during normal use on those phones.
• Side effect: removing only one earcup will not pause media — both earcups need to come off. This is a deliberate trade-off that fixes the reporter's primary complaint without breaking the Android-only path.
• Scope: Max 2 (A3454) only. Max gen 1 (A2096) has different bit semantics with shipping tests; left unchanged. Max USB-C (A3184) only has a 0x2B sample where old and new logic both return worn; cannot determine its layout without an unworn sample, so left unchanged pending a follow-up.

Review checklist

• Confirm dashboard In ear flag toggles between worn/unworn states on a real Max 2
• Confirm auto play/pause triggers when both earcups come off
• Confirm the value flowing through the dashboard is BLE-derived, not AAP-derived (debug overlay should show pubStatus toggling 0x21 ↔ 0x23)

Closes #548