CircuitBreaker: measure the failure window from the previous failure

last_failure_time_ was updated before IsWindowExpired() read it, so the
window never expired and widely spaced failures still opened the
breaker.

Audit finding D8.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015rcVQiiWyTzoNrsvLSaAfB

ErrorRecovery.cc

@@ -73,13 +73,15 @@ CircuitBreaker::RecordFailure()
 {
 	std::lock_guard<std::mutex> lg(mtx_);
 
-	const auto now     = std::chrono::steady_clock::now();
-	last_failure_time_ = now;
+	// The window is measured from the previous failure, so check it before
+	// recording this one.
+	const bool window_expired = IsWindowExpired();
+	last_failure_time_        = std::chrono::steady_clock::now();
 
 	switch (state_) {
 	case State::Closed:
 		// Check if we need to reset the failure count (window expired)
-		if (IsWindowExpired()) {
+		if (window_expired) {
 			failure_count_ = 0;
 		}