Move StartLimit* keys to [Unit] so systemd honors them
systemd rejects StartLimitIntervalSec and StartLimitBurst in [Service]
(they were renamed to [Unit] in systemd 230). In the previous template
they sat under [Service] and were silently ignored, so the observer had
no crash-loop rate-limiting in practice.
Existing installs pick up the fix on the next `make install-service`
run; no manual migration needed.