[panfilov-vladislav]

Problem

Service::run() is documented to never complete unless it errors, but its
local_server.accept() arm propagated any accept error with ? — tearing down
the entire service (all local and remote connections, repo expiration,
everything), not just the local listener.

The local listener's socket can be invalidated by the OS independently of
anything the service does — e.g. iOS tearing down a backgrounded app's sockets.
Nothing recreated the listener, so once that happened the backend was
permanently dead until the app restarted. This is what presented as file
previews and network status hanging indefinitely after a background/foreground
cycle: the Dart client's reconnect-with-backoff kept retrying forever against a
service that had already stopped listening.

Fix

• Rebind on accept error with capped exponential backoff instead of
  propagating it. local_server becomes Option<LocalServer> (None only
  transiently during a rebind) so the dead listener is dropped before binding
  the replacement — binding the same port while the old value is still alive
  fails with AddrInUse even once its socket is unusable at the OS level (the
  regression test caught this).
• Safe cancel/restart. run() is documented as safe to cancel and restart,
  but a cancel mid-rebind left the longer-lived Service with no listener, and
  the next run() panicked on the expect/unwrap. The resolved local
  endpoint now lives in its own field, and run() rebinds at the top of its
  loop whenever local_server is None — a restart that finds no listener
  rebinds instead of panicking, and local_endpoint() no longer unwraps an
  Option. Added a regression test that starts run() with a missing listener.