[Idea] Add retry + exponential backoff + circuit breaker around ORS calls

[sfc-gh-obielov]

Triage note (2026-04-23): Part of the ORS client hardening epic alongside #51 (request-size guardrails) and #56 (per-endpoint latency + error log).

Epic ordering hint: #56 must land first — the ORS_REQUEST_LOG table it creates is the input signal this ticket's circuit breaker reads to decide when to open/close. Without #56 this ticket would need to invent its own observability plumbing. After #56, this ticket's breaker thresholds can be tuned against real p50/p95/error-rate data instead of guessed constants.

---

Context

The public ORS service has been hit by repeated 503s from load-balancer issues, acknowledged The public ORS service has been hit by repeated 503s from load-balancer issues, acknowledged The public ORS service has been hit by repeated 503s from load-balancer issues, acknowledged The public ORS service has been hit by repeated 503s from load-balancer issues, acknowledged The public ORS service has been hit by repeated 503s from load-balancer issues, acknowledged The public ORS service has been hit by repeated 503s from rix avoid_polygons is silently ignored](https://ask.openrouteservice.org/t/avoid-polygons-not-working-with-matrix-api-for-multiple-locations/) for large payloads. Our UDFs/notebooks can hammer the internal service unbounded.

Proposal

• Reject Matrix calls above maximum_routes_flexible.
• Reject Isochrones beyond configured range/interval limits.
• Validate avoid_polygons shape and surface a warning if dropped.
• Return structured 4xx-style errors instead of silent success.

Benefit

Prevents silent failures and protects the shared SPCS service from a runaway caller.

References

• https://ask.openrouteservice.org/t/error-overquerylimit-retrying/
• https://ask.openrouteservice.org/t/avoid-polygons-not-working-with-matrix-api-for-multiple-locations/

[sfc-gh-obielov]

Addressed in PR #120 (commit 385a7c4).

Implementation in services/gateway/routing_service.py:

• Per-host circuit breaker (CLOSED → OPEN → HALF_OPEN) with rolling failure window. Opens after ORS_BREAKER_FAILURE_THRESHOLD (default 5) within ORS_BREAKER_ROLLING_WINDOW_S (default 30s). 30s cooldown before half-open probe.
• Retry up to ORS_RETRY_MAX_ATTEMPTS (default 3) on 5xx. Timeouts and service_warming_up are NOT retried (correct — they need a different code path).
• Exponential backoff with jitter.

Audit follow-ups applied:

• Replaced deterministic 3-value jitter (req_id[-2:].count('a') / 2) with random.uniform(0.75, 1.25) so simultaneous callers don't synchronize retries.
• Added depth-2 guard + _partial: true marker + failed_destinations list to _retry_matrix_chunked so silent partial-result drops are now visible to callers.