Login rejections could schedule and execute multiple restarts for one failure while leaving no usable console route during reconnect delays.
Changes:
- Bind failure and restart work to immutable connection attempts
- Coalesce automatic retries while allowing explicit settings replacement until commit
- Preserve held bots and offline command routing across failed logins
- Add deterministic retry, ownership, and routing regression tests
Fixes#3186