Circuit breaker

When a backend goes down, a client without a breaker keeps sending requests that hang until they time out, and in-flight work piles up. A circuit breaker opens after repeated failures and fails fast instead, then lets a probe through to check for recovery.