fix: enable KillSwitchService auto-recovery by default with circuit breaker (#373)

[graceful-tech12]

Summary

Fixes #373 — KillSwitchService Auto-Recovery Disabled by Default

Problem

The HSM integration was initialized with enableAutoRecovery: false, meaning when the KillSwitchService activated, the system entered a permanently locked-down state requiring manual admin intervention.

Changes

• Enable auto-recovery by default with 5-minute initial delay and exponential backoff
• Circuit-breaker probe pattern: health check before full deactivation; if probe fails, double backoff and retry
• Source-based recovery delays: HSM transient failure → 30s, system failure → 2min, security incident → 5min
• Max recovery attempt limit (default: 5) with escalation to human operators when exhausted
• Prometheus gauge kill_switch_recovery_attempts for monitoring
• 6 new test cases for auto-recovery scenarios
• Fixed pre-existing duplicate metric name collisions in prometheus.ts

Files Changed

File	Lines
backend/src/services/killSwitchService.ts	+240/-30
backend/src/services/hsmIntegration.ts	+7/-2
backend/src/index.ts	+3/-1
backend/src/utils/prometheus.ts	+13/-2
backend/src/tests/hsm.integration.test.ts	+165/-4

Test Results

✅ 247/247 tests pass across all 16 test suites (zero regressions)

Acceptance Criteria

• Enable auto-recovery by default with reasonable delay + exponential backoff
• Max recovery attempt limit (5) with escalation to human operators
• Circuit breaker pattern: probe → succeed → restore; fail → double backoff
• Separate HSM transient failure trigger (30s) vs security incident (5min+)
• Test: threshold breach → auto-recovery → successful recovery → normal operation
• Test: HSM failure → shorter recovery delay than security incident
• Prometheus gauge kill_switch_recovery_attempts