keep service containers' boot-wait budgets under their start limit, and check it

docs/swarm/credentials.md

@@ -89,7 +89,7 @@ The same unit mints the client secrets, straight into the store. It reads
 only when the store answers and holds none does it run `authelia crypto hash generate`,
 create the leaf and write the digest. Authelia keeps only the digest on disk, in
 `oidc-clients/<id>.digest`, and starts from it while the store is down. A store that
-can't answer a read never mints, because a second secret would rotate the first. When it can't read the store, the unit still writes authelia's client file from the digests, then exits non-zero and retries every 15 seconds, so authelia starts meanwhile and `swarm-authelia-bridge` finds its secret once the store answers. A client with a
+can't answer a read never mints, because a second secret would rotate the first. When it can't read the store, the unit still writes authelia's client file from the digests, then exits non-zero and retries after 15 seconds, then at growing intervals up to two minutes, so authelia starts meanwhile and `swarm-authelia-bridge` finds its secret once the store answers. A client with a
 secret in the store but no digest gets the digest of that secret and keeps the secret; `authelia crypto hash generate` computes the digest,
 with the password typed into its prompt through a pty, never in a command line.
 `swarm-authelia-bridge` fetches its own secret from