Rewrite Restart wrapper: fluent API, consecutive error counting, panic recovery

[pior]

• Fluent API — Restart now returns *restart with chainable methods (.Limit(), .ErrorLimit(), .Delay(), .ErrorBackoff(), .ErrorResetAfter()), replacing the functional options pattern (RestartOption, RestartLimit, RestartCrashLimit, etc.). This aligns with the other configurable wrappers (Manager, HTTPServer).
• Rename crash → error — "crash" was misleading in Go (returning an error isn't crashing). All terminology now uses "error": ErrorLimit, ErrorBackoff, ErrorResetAfter, and log fields say errors=N instead of crash=N.
• Consecutive error counting — errorCount now resets to 0 after any successful run. Previously crashCount accumulated across successes (total budget). ErrorLimit means "max consecutive errors", which is more useful operationally.
• ErrorResetAfter — New feature: resets the error count when a run lasted long enough before failing. Prevents long-running services that occasionally fail from accumulating stale error counts into the backoff.
• Built-in panic recovery — Restart now wraps the inner runnable with Recover(), matching how Manager handles panics. No need to explicitly write Restart(Recover(worker)).
• Early context cancellation check — The restart loop checks ctx.Err() immediately after each run, stopping without counting errors or calling backoff.