[RELIABILITY][PROVIDERS] Add timeouts, bounded retries, and circuit breakers to external payment and FX calls

[Obiajulu-gif]

Summary

Several payment and FX mutations call external providers without an abort deadline or shared resilience policy. A hung connection can consume serverless duration, strand UI actions, and amplify retries.

Repository evidence

• app/api/payments/initialize/route.ts and app/api/payments/down-payment/route.ts call Paystack without an abort signal.
• The down-payment route also fetches a live FX endpoint without a timeout or response-status contract.
• Provider adapters are spread across route and service modules with inconsistent failure handling.

Scope

• Create a shared outbound HTTP policy with connect/overall deadlines, bounded retry rules, jitter, and circuit state.
• Retry only demonstrably safe/idempotent operations and preserve provider references across attempts.
• Emit redacted provider latency, timeout, circuit, and terminal outcome metrics.

Acceptance criteria

• Every external financial request has a documented deadline.
• Unsafe POSTs are never blindly duplicated and timed-out outcomes are reconciled by reference.
• A failing provider cannot exhaust the worker pool indefinitely.

Tests

• Hung socket, slow body, retryable/non-retryable status, ambiguous timeout, circuit open/half-open, and idempotent retry tests.

Non-goals

• Changing payment or FX vendors.