fix: requests never wait on an unavailable WebDecoy, and buffers stay bounded

[cport1]

Problem: while WebDecoy was slow or unavailable:

• protect() waited the full timeout (default 5s) on every suspicious request before failing open.
• Every failure logged an error.
• The violation buffer, AI referral counts and IP enrichment cache could grow without limit.
• A 429 on AI referrals was treated as delivered.

Fix

• One pause for every call: after a 429, a 5xx or no answer, the client pauses. It uses Retry-After when given, otherwise 1s doubling to 60s.
  • Calls during the pause throw WebDecoyUnavailableError without a request, so protect() returns ERROR at once (fail open, as before).
  • A 4xx answer is not an outage.
• Logging: the failure that starts the pause logs at error; paused requests log at debug.
• Bounded buffers:
  • Violations are held while paused (cap 1,000, oldest dropped) and sent on recovery.
  • The enrichment cache is capped at 10,000.
  • Referral counting stops adding new pairs, and stops triggering sends, while an unsent batch waits.
• 429 on referrals: the batch is kept and retried under the same id.

Tests: 506 pass (9 new in src/outage.test.ts), plus tsc and eslint.

• Mutation-checked: removing the pause gate, the quiet log, either cap, or the 429 handling each fails a test.