## System details

- Hardware: Lenovo ThinkPad L480
- Omarchy: 4.0.0-1
- Kernel: 7.1.8-arch1-3
- BlueZ: 5.87-2

## What's wrong?

With Bluetooth powered on and the Omarchy Bluetooth panel closed, the adapter remains pairable indefinitely:

```console
$ bluetoothctl show | grep -E 'Powered|Discoverable|Pairable|Discovering'
Powered: yes
Discoverable: no
Pairable: yes
Discovering: no
```

`PairableTimeout` uses the BlueZ default of `0`, so pairable mode does not expire. The default pairing agent runs for the entire graphical session:

```console
$ systemctl --user status bt-agent.service
/usr/bin/bt-agent -c NoInputNoOutput
```

## Expected behavior

The comment in `/usr/lib/systemd/user/bt-agent.service` says:

> NoInputNoOutput auto-accepts pair requests. Safe because the adapter is only `pairable: true` when the user explicitly opens the omarchy bluetoothPanel and starts scanning; outside that window bluez refuses inbound pair attempts at a lower layer.

The adapter should therefore be non-pairable whenever the Bluetooth panel is closed.

## Actual code path

`/usr/share/omarchy/shell/plugins/panels/bluetooth/Panel.qml` starts discovery while the panel is open and stops it after closing by writing:

```qml
root.adapter.discovering = true
root.adapter.discovering = false
```

However, the panel never reads or writes `adapter.pairable`. Quickshell exposes `pairable` as a writable adapter property, but BlueZ remains at its default `Pairable: true`.

## Security impact

A nearby device that knows the adapter's public Bluetooth address may initiate an incoming pairing attempt while the panel is closed.

Because the default agent advertises `NoInputNoOutput`, pairing may fall back to “Just Works” without user confirmation, depending on the peer and negotiated security requirements. `Discoverable: no` reduces exposure but does not enforce the security boundary described by the service comment.

No pairing attempt or exploit was performed while investigating this issue.

## Minimal fix

Tie `adapter.pairable` to the Bluetooth panel lifecycle:

- Set it to `true` while at least one Bluetooth panel is open and the adapter is powered.
- Set it to `false` after the last panel closes, is destroyed, or Bluetooth is turned off.
- Preserve the existing multi-monitor discovery ownership logic.
- Keep `NoInputNoOutput`; reconnection of already paired devices should remain unaffected.

A fixed timeout alone is insufficient because the current panel does not re-enable pairable mode on later opens.

## Steps to reproduce

1. Log in with Bluetooth enabled.
2. Confirm that `bt-agent.service` is running.
3. Open the Omarchy Bluetooth panel and let it scan.
4. Close the panel and wait a few seconds.
5. Run:

   ```console
   bluetoothctl show | grep -E 'Powered|Discoverable|Pairable|Discovering'
   ```

6. Observe:

   ```text
   Powered: yes
   Discoverable: no
   Pairable: yes
   Discovering: no
   ```

Expected after closing the panel:

```text
Pairable: no
```