cli: honor Hosted 429 Retry-After during ingest sync #43

Problem

Hosted rate limits return 429 with Retry-After (apps/api/src/mutiny_api/rate_limit.py). CLI ingest sync (packages/mutiny_cli/src/mutiny_cli/hosted_sync.py) should be checked for retry/backoff — grep shows little/no 429 / Retry-After handling in the sync client path.

Under default single-tenant limits this is rare; bursty end-of-run artifact upload can still trip limits and fail the whole --hosted sync (exit 3) without retry.

Repository evidence

• rate_limit.py — Retry-After computation
• hosted_sync.py — HTTP posts for ingest envelopes
• SECURITY.md — 429 semantics

Why it matters

mutiny run --hosted promises local success + sync; a transient 429 should not look like a permanent ingest failure if Retry-After is short.

Proposed direction

On 429, sleep Retry-After (capped) and retry a small number of times for idempotent ingest posts (client_event_id already supports idempotency). Document behavior in docs/HOSTED_INGESTION.md / CLI.md.

Acceptance criteria

• 429 with Retry-After triggers bounded retry
• Non-429 errors unchanged
• Unit test with mocked HTTP 429 then 200
• No weakening of redaction requirements

Testing expectations

uv run pytest tests/unit/test_cli_hosted_sync.py -q

Difficulty

M · CLI