offline: three-way mode never | store-overloaded | offline, with a per-upstream circuit breaker

never is today's behaviour; offline is the switch of !33 (merged); store-overloaded stays online (and does send upstream traffic) but, when an upstream shows trouble (transport error, timeout, 429, 5xx), opens a per-host circuit breaker: no upstream traffic for 30s doubling to 10min (honouring Retry-After), then one probe, and closes again on success. Lives in the existing offline.Switch.Transport/Dial wrappers so every backend gets it. Flag -offline-mode, admin PUT /v1/offline {"mode": ...}, state in the stats API. Part of #54 (closed).