fix(sync): failure-backoff so a dead remote isn't probed every command (#133)

[arimxyer]

Closes #133.

Problem

The pre-unlock TTL-gate (#103) only stamped LastPullCheck on a successful probe. So with sync enabled and the rclone remote down/slow, every command re-probed and blocked for the full 8s probe timeout:

Warning: failed to check remote state: rclone lsjson failed: timed out after 8s

The gate that was supposed to skip re-probing never opened, because a dead remote never records a check.

Fix (issue option 1 — the root cause)

A failed probe now stamps a separate LastPullFailure and enters a backoff (reusing the pull_ttl_seconds window, default 30s):

• SmartPull skips the probe while the backoff is active and serves the local vault → a dead remote costs the timeout at most once per window instead of every call.
• A successful contact clears the failure (stampSuccess), so recovery re-enables normal sync immediately.

Data-loss safety (the important part)

A write during the backoff is deferred, not pushed. The advisor flagged the trap: the remote can recover mid-window, so "the remote is down, a push can't overwrite anything" is false. Blind-pushing (or letting rclone sync fail — which is unbounded, not 8s-capped) would silently overwrite a remote that another device updated during the window. Deferring keeps the local change local until the next command after the window expires, when a fresh probe can conflict-check. The existing success-skip path is unchanged (still does its push-time conflict check).

Scope

• Reuses the existing pull_ttl_seconds knob as the backoff window (one knob, no new config).
• A configurable probe timeout (issue option 2) is left as a follow-up — a slow-but-alive remote (>8s) is treated as failed.

Tests

5 new tests in internal/sync/sync_test.go:

• probe error stamps LastPullFailure (not LastPullCheck)
• backoff skips the re-probe (0 Run calls)
• backoff expiry re-probes
• success clears the failure
• SmartPush defers during backoff: 0 probe calls, 0 push calls, LastPushHash untouched

Full unit + integration suite green; golangci-lint clean.

🤖 Generated with Claude Code