fix(ota): repair a stale Restart=on-failure unit that leaves nodes dead after update

austin-sapien (100.70.96.88) sat dead for over two hours after taking
v1.7.122 — 'server starting' in the UI, service inactive, exit status
0/SUCCESS. It did not crash: the in-process updater replaces the binary and
exits cleanly for systemd to restart it, and that node's unit still carried
Restart=on-failure from an older install. systemd read the clean exit as
success and left it stopped. Every node with the old unit has this waiting
for it on the next update.

self-update.sh does refresh units, but the in-process update path never
runs it, so nothing was repairing them. The daemon now checks its own unit
at boot and rewrites only the Restart= line, so a node that starts even
once ends up with a policy that survives the next update.

Also carries the session-policy wiring: validate() now honours the
configured idle and absolute limits and the per-device class, instead of
the single hard-coded 24h constant.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

core/archipelago/src/main.rs

@@ -409,6 +409,11 @@ async fn main() -> Result<()> {
     // flags) on already-deployed nodes via OTA; no-op if the kiosk isn't installed.
     tokio::spawn(bootstrap::ensure_kiosk_hardened());
 
+    // Repair our own restart policy before anything else can need it: a node
+    // whose unit still says Restart=on-failure stays dead after the next
+    // in-process update, because the daemon exits cleanly to be restarted.
+    tokio::spawn(bootstrap::ensure_restart_policy());
+
     // HDMI audio: install the PipeWire stack + audio-router daemon on kiosk
     // nodes (older ISOs shipped no audio stack; the router also heals the
     // boot-time ELD race that leaves HDMI silently unavailable).