fix(server): wait out transient EADDRINUSE with bounded bind retries

[chaucerj]

Description

openviking-server bound its listen socket inside uvicorn.run, which logs a bind failure and exits gracefully — so a supervised restart (watchdog, systemd Restart=always, Docker healthcheck) racing the old process winding down killed the new process on the first EADDRINUSE.

The socket is now bound up front, retrying while the port is held (server.bind_retry_attempts, default 5; server.bind_retry_interval_seconds, default 1.0; 0 attempts keeps the die-immediately behavior), and then handed to uvicorn: Server.run(sockets=[...]) for the single-process path, and the inherited fd= for the multi-worker path, since uvicorn 0.41's run()/Config take no sock parameter and run() swallows the bind error instead of raising.

Human Involvement

• A human participated in the implementation or review loop

Related Issue

Fixes #5401

Type of Change

• Bug fix (non-breaking change that fixes an issue)

Changes Made

• openviking/server/bootstrap.py: _bind_socket_with_retry (bounded EADDRINUSE retries with a stderr note per attempt) + _run_uvicorn handing the pre-bound socket to uvicorn per mode; both startup call sites routed through it.
• openviking/server/config.py: server.bind_retry_attempts / server.bind_retry_interval_seconds with the rationale in the field description.
• tests/server/test_bootstrap_bind_retry.py: real-socket tests for the waited-out holder, exhausted retries (original OSError semantics), zero-attempts fail-fast, free-port no-retry, and conservative defaults.

Testing

• pytest tests/server/test_bootstrap_bind_retry.py: 6/6 pass; ruff check clean.
• Live runs against a local server: port held → "still in use (attempt n/8)" retries → holder released → /health 200; port held forever → retries exhaust → original OSError; free port → unchanged startup.

🤖 Generated with Claude Code