Per-provider circuit breaking

A failing provider connection is isolated instead of retried into the ground, with automatic recovery.

Each provider connection tracks its own health: closed → open → half-open → closed.
After 3 consecutive retryable failures the connection is held out for a 5-minute cooldown, then offered exactly one half-open probe before rejoining rotation.
Client errors (4xx) never count toward the breaker; only timeouts, rate limits, and 5xx responses do — an unavailable primary falls back or returns 503.