outlast openbao's cold restart in the agent ca unit's start limit

nix/host-modules/swarm-bao.nix

@@ -59,6 +59,9 @@ let
   openbaoStartSec = 240;
   containerStartSec = openbaoStartSec + 60;
 
+  # systemd's default stop limit, which bounds the stop half of a restart.
+  openbaoStopSec = 90;
+
   # Upstream's own default, kept so its documentation matches. The raft data
   # lives INSIDE the container on `ephemeral = false`, the same way
   # ./swarm-grafana.nix keeps its sqlite database — no sibling service binds
@@ -3950,9 +3953,10 @@ in
           Restart = "on-failure";
           RestartSec = 30;
           # An attempt may generate a 4096-bit RSA root and then wait on a
-          # blocking restart of openbao: its stop and its start, 90s each by
-          # systemd's defaults.
-          TimeoutStartSec = "5min";
+          # blocking restart of openbao: its stop (`openbaoStopSec`) and its
+          # start (`openbaoStartSec`), plus 120s for the key generation and
+          # the calls around it. 90 + 240 + 120 = 450s.
+          TimeoutStartSec = "${toString (openbaoStopSec + openbaoStartSec + 120)}s";
         };
         script = ''
           set -euo pipefail