feat(backend): harden reliability — timeouts, circuit-breaker, retry,…

[Chidubemkingsley]

• closes Add request timeout and cancellation handling #1237

• closes Add circuit breakers for Soroban RPC and Horizon #1238

• closes Add retry with jitter for transient upstream failures #1239

• closes Add request body size limits per route #1224

• Add explicit timeouts for all outbound HTTP (Soroban RPC, Horizon, IPFS, X API) via fetchWithTimeout / withTimeoutAndSignal; timeouts are configurable through env (SOROBAN_RPC_TIMEOUT_MS, HORIZON_TIMEOUT_MS, IPFS_TIMEOUT_MS, X_API_TIMEOUT_MS) and merged with client-disconnect AbortSignal (req.signal)

• Server-level request timeout middleware (REQUEST_TIMEOUT_MS, default 30s) returns 503 REQUEST_TIMEOUT and aborts in-flight upstream work; client close also aborts via AbortSignal

• Extract X circuit breaker into shared utility src/common/utils/circuitBreaker.ts; re-export from x.circuit-breaker.ts so x.circuit-breaker.test.ts passes unmodified; apply breaker to RPC (Soroban) and Horizon with fast-fail 503 SERVICE_UNAVAILABLE, logging and metrics exposure via /metrics (circuitBreaker states, timeouts)

• Standardise retry in src/common/utils/retry.ts with exponential backoff + full jitter, non-retryable 4xx / non-idempotent guard, configurable ceiling, logged attempts; indexer/retry.ts re-exports shared implementation for backward compat

• Right-size payload limits: default JSON 100kb (configurable JSON_BODY_LIMIT, down from 1mb), per-route larger 500kb for /tips /profiles /auth, multer files:1 fields:10 fileSize 5MB; oversized bodies mapped to 413 PAYLOAD_TOO_LARGE in errorHandler instead of HTML

Closes #90, #91, #92, #77

Description

Closes #

Type of Change

Please mark the options that are relevant:

• 🐛 Bug fix (non-breaking change which fixes an issue)
• ✨ New feature (non-breaking change which adds functionality)
• 💥 Breaking change (fix or feature that would cause existing functionality to not work as expected)
• 🧪 Tests (adding new tests or updating existing tests)
• 📝 Documentation (changes to documentation/configs only)
• 🚀 DevOps & CI/CD (changes to workflows, scripts, or templates)

Changes Made

How to Test

Checklist

💻 Smart Contract Changes (if applicable)

• Running cargo fmt -- --check passes successfully.
• Running cargo clippy -- -D warnings runs without any warnings.
• All tests pass successfully using cargo test.
• New unit or integration tests have been written to cover the changes.
• No hardcoded values are present (e.g. addresses, fees) that should be configurable.

🎨 Frontend Changes (if applicable)

• TypeScript compiles cleanly with no errors (npm run typecheck or npx tsc --noEmit).
• Running npm run lint shows no linting errors.
• The production build compiles successfully via npm run build.
• Changes verified on local browser environment with Freighter/xBull/Albedo wallet.
• Responsive design verified (tested on mobile, tablet, and desktop viewport sizes).
• Keyboard navigation and accessibility (a11y) considerations are addressed.

⚙️ General

• Code follows the project's coding standards and structure guidelines.
• Self-reviewed the changes to ensure clean code with no commented-out code blocks.
• No console.log or debug code remains in production files.
• The branch is up-to-date with the main branch.

Screenshots / Demos (if applicable)

[drips-wave]

@Chidubemkingsley Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits