Report a rate-limited bank sync as a wait, and name real failures

Two of three banks were only pacing us, yet the dashboard demanded attention,
printed four nested wrappers and a nanosecond UTC deadline, and the scheduler
retried hourly into a refusal whose end time the bank had already given.

A rate limit now carries its retry time as data: Status.SyncRetryAt is set when
every failure is self-clearing, the connection reports rate_limited with that
deadline, the dashboard says synchronization resumes by itself and renders the
time in the browser's zone, and the scheduler sleeps until the deadline instead
of spending hourly session checks. Sync now still tries immediately.

The third bank's "transaction retrieval failed" hid its cause. Provider
failures Finance Duck determines itself are typed as banking.ProviderError,
so an unreachable provider, a timeout or an unusable response, such as a booked
transaction without a booking date, is reported instead of the opaque fallback.
Provider response text still never reaches the message.

OPERATIONS.txt

@@ -281,7 +281,20 @@ account's history. Reconnection preserves the saved history choice and existing
 cursors. Changing the choice or reconnecting does not backfill already-synced
 accounts. Older records can be imported using CSV. Older saved consents without
 a history choice use 12 months for accounts that have no successful-sync cursor.
-A failed provider call retains local data and is retried by the daily scheduler;
+A failed provider call retains local data. Failures whose cause Finance Duck
+determines locally are named: a bank rate limit with its retry time, an expired
+consent, an HTTP status, an unreachable provider, or a response the journal
+cannot use (for example a booked transaction without a booking date). Only an
+unrecognized cause falls back to "transaction retrieval failed". Provider
+response text is never shown.
+
+While every failing bank has named its own retry time, the account is reported
+as waiting, not broken: the dashboard says synchronization retries by itself,
+the account card shows a rate-limit badge with that time, and the scheduler
+sleeps until the deadline instead of spending hourly session checks on a
+refusal it already knows about. Sync now still tries immediately. Any failure
+without such a deadline keeps the hourly retry. Retry times are persisted with
+the sync state in whole seconds and rendered in the browser's time zone.
 Sync now can retry sooner. Balances are fetched
 on demand, with exact amount/currency/type values, rather than inferred from an
 incomplete historical journal.