Add circuit breaker to arrs_failed_stalled_recovery.sh

Some items (e.g. an album missing 1-2 tracks where no available release
matches the existing edition/track count) can never resolve via blind
retry. Without a limit, the same media ID gets blocklisted and re-searched
every 4 hours forever — confirmed live on ~19 Lidarr albums cycling
identically across five consecutive runs today, each one downloading a
fresh release, failing import for the same structural reason, and
starting over.

Tracks consecutive failures per (arr_type, media_id) in a persisted state
file. After ARR_RECOVERY_MAX_ATTEMPTS (default 3) failures, the item is
still blocklisted and removed from the queue, but auto re-search stops —
notified once when it crosses the threshold, then left for manual review
instead of retried forever.

Deployment/master.conf.template

@@ -1215,6 +1215,8 @@
 # Per-host recovery toggles (HOST1_SONARR_RECOVERY etc.) live in host*.conf.
     ARR_IMPORT_RECOVERY_AGE=6           # hours — skip items newer than this
                                         # matches cron interval — items eligible after one missed cycle
+    ARR_RECOVERY_MAX_ATTEMPTS=3         # consecutive failures before an item is flagged chronic
+                                        # and auto re-search stops (still blocklisted/cleaned up)
 
 # ==============================================================================================
 # ── TRANSCODES ────────────────────────────────────────────────────────────────────────────────
@@ -1328,6 +1330,7 @@
 # All in DATA_DIR — array always running when these are written.
     ARR_CLEANUP_STATS="$DATA_DIR/arr_cleanup_stats.db"     # lidarr/sonarr/radarr orphan stats
     ARR_RECOVERY_STATS="$DATA_DIR/arr_recovery_stats.db"   # blocklist + re-search stats
+    ARR_RECOVERY_FAILURE_COUNTS="$DATA_DIR/arr_recovery_failure_counts.db"  # per-item chronic-failure tracking
 
 # ━━━ Health Digest ━━━
 # Aggregated system health summary — reads existing state files, no new writes.