Hardening 8: isolate external provider sources with timeouts, cancellation, and circuit breakers

[Occumed79]

Parent: #170

Goal

Make NPI, Overpass, geocoding, and other external-source failures degrade cleanly without freezing the map, erasing good results, or leaving endless loading states.

Required source policy

For every external source define:

• strict connect/overall timeout
• AbortController cancellation and upstream propagation
• retry policy limited to safe transient failures with bounded attempts/backoff
• circuit-breaker thresholds/cooldown
• per-source concurrency limit
• cache policy and freshness rules
• normalized health/status state
• provenance and partial-results behavior

Behavioral requirements

• No infinite or recursive fallback chains.
• A secondary source failure must not discard successful source results.
• Existing rendered results remain until a replacement result set is ready or the user explicitly clears them.
• Loading state always settles on success, partial success, cancellation, or failure.
• Superseded searches are cancelled, not merely ignored after completion.
• Overall search responses explicitly identify unavailable/timed-out sources and whether results are incomplete.
• Source health is separate from overall application liveness/readiness.
• Frontend shows a clear degraded/incomplete-results state without presenting it as complete coverage.

Acceptance

• Deterministic tests simulate timeout, DNS/network error, 429, 5xx, malformed response, cancellation, and circuit-open behavior per source.
• No source can hold the whole request open beyond the defined request deadline.
• Partial success returns successful normalized results plus degraded-source metadata.
• Circuit breakers recover after cooldown/probe success.
• Cache behavior and stale-data handling are documented and tested.
• Repeated failed external requests do not cause runaway concurrency or memory growth.