v0.17.1 — resilient LLM calls + calmer error display

Fixes #30.

• Retry on transient failures — a momentary LLM overload (e.g. Gemini 503), rate-limit (429) or network/timeout blip is now retried with exponential backoff instead of throwing away the whole cycle. Genuine errors (auth 4xx, malformed responses) still fail fast to a safe HOLD.
• No raw errors on the dashboard — a failed cycle shows a calm ⏳ RETRY — retrying at next decision · in Xh Ym note instead of the raw provider error. API keys are also scrubbed from error strings so they can never reach the ledger or the page.