v0.18.1 — retries survive restarts (systemd timer)

Follow-up to #30.

• The short retry of a failed sleeve is now driven by the magpie-retry systemd timer (every few minutes) instead of an in-process timer, so a pending retry survives a container restart — consistent with Magpie's other timers.
• Retries are bounded by CYCLE_RETRY_MAX consecutive attempts (reset by each scheduled cycle) so a sustained outage can't retry forever; POST /api/cycle/retry?force=true bypasses the cap for a manual retry.