Watchdog can't actually reset the MCU; 'reboot' is jmp 0

[ramereth]

setup_watchdog() enables WDIE but never WDE, so the watchdog only fires an
interrupt — it can never reset the chip. Both "reboot" paths are software jumps:

if (dogcount > 100000 / 30) { OSCCAL = osc; asm volatile ("  jmp 0"); }   // timeout
case 'a': OSCCAL = osc; asm volatile ("  jmp 0");                          // menu

jmp 0 re-enters the reset vector without resetting anything else: I/O
registers, timers, the SPI peripheral and the W5500 all keep their state. A
wedged peripheral survives the "reboot" that was supposed to clear it.

Fix: enable WDE and let the hardware watchdog do a real reset, or trigger
one deliberately (wdt_enable(WDTO_15MS); for(;;);).

⚠ One deliberate consequence to weigh first. A real reset drops the 5-28 V
output for about a second: PD3 goes high-Z, R17 pulls Q1's gate down, and R7
pulls the P-FET gates to VIN. jmp 0 does not, because the I/O registers keep
their state.

So for a node powered through VOUT, today's soft reboot is the safe one and
a real reset power-cycles the machine. Any fix here needs to either keep the
menu a path soft, or make that consequence explicit to the operator.