fix(alarm): stop corrupt entries and unreadable payloads from wiping saved alarms

A single malformed alarm entry (bad/missing id, wrong type) used to
discard the ENTIRE persisted list on next load, and a fully unparseable
payload let the periodic recalculation silently overwrite it with an
empty one -- both destroyed valid alarms with no user action.

Adds a shared per-entry tolerant-parse helper (persistencia_tolerante.dart)
that skips and logs only the bad entry; ServicioAlarmas now normalizes its
cached raw after a partial load (no dirty-guard thrash) and sets a
degraded-read flag after a total decode failure that suppresses automatic
writes until a good read or an explicit user mutation restores authority.

lib/modelos/alarma_musical.dart

@@ -142,6 +142,14 @@ class AlarmaMusical {
     'actualizadaEn': actualizadaEn?.toIso8601String(),
   };
 
+  // persistence-resilience (D2): `id` stays a REQUIRED, un-defaulted cast
+  // on purpose -- a missing/wrong-type id must throw, not fall back to a
+  // fabricated value. Callers that read persisted collections (e.g.
+  // ServicioAlarmas._parsear via persistencia_tolerante.dart) wrap each
+  // fromJson call in a per-entry try: a thrown entry is skipped and
+  // logged, never replacing this required field with a sentinel/fabricated
+  // id ("skip-never-fabricate"). This boundary also tolerates any future
+  // required-field break the same way, not just id.
   factory AlarmaMusical.fromJson(Map<String, dynamic> json) {
     return AlarmaMusical(
       id: json['id'] as String,