feat: atomization pipeline with job queue, atomizer client, WS hub, and board UI (phase 7)

- internal/extsvc: circuit breaker (§11.16) + retrying bearer JSON client
- atomizer client: §5.1 contract incl. defensive coefficient normalization
  and extension coefficient range (0,2]
- persisted jobs collection: atomic claim, panic recovery, exponential
  backoff (max 3), stale-running requeue, shutdown-safe bookkeeping
- subdivide (async 202, atomizing status, re-run replaces unpublished
  children after confirm) and extend (sibling task, source budget)
- failure path reverts status and notifies the consultant on final attempt
- PATCH task editing with bounty recompute, budget cascade to descendants
- publish single + bulk; task detail endpoint role-scoped
- coder/websocket hub: multiplexed channels, origin check, 30s heartbeats;
  client ws.js with reconnect + 15s polling fallback
- consultant atomization board: tree by root, coefficient sliders with live
  per-parent sum indicator, bounty preview, modals, shimmer, atomizer-down
  gating via /api/v1/service-health
- fix: tasks external-ref unique index is partial, not sparse (compound
  sparse indexed every task through customerId and broke child inserts)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

internal/extsvc/breaker.go

@@ -0,0 +1,73 @@
+// Package extsvc holds shared plumbing for the two independent external
+// services (Atomization, Work Performer): a small circuit breaker and a
+// retrying JSON HTTP helper. The services themselves stay fully independent
+// (§5) — each gets its own breaker instance, base URL, and token.
+package extsvc
+
+import (
+	"sync"
+	"time"
+)
+
+// Breaker implements §11.16: open after 3 consecutive failures, half-open
+// probe every 60 s.
+type Breaker struct {
+	mu        sync.Mutex
+	fails     int
+	openedAt  time.Time
+	probing   bool
+	now       func() time.Time
+	threshold int
+	cooldown  time.Duration
+}
+
+func NewBreaker() *Breaker {
+	return &Breaker{now: time.Now, threshold: 3, cooldown: 60 * time.Second}
+}
+
+// Allow reports whether a call may proceed right now. In the open state one
+// probe is allowed per cooldown window (half-open).
+func (b *Breaker) Allow() bool {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	if b.fails < b.threshold {
+		return true
+	}
+	if b.probing {
+		return false
+	}
+	if b.now().Sub(b.openedAt) >= b.cooldown {
+		b.probing = true // half-open: exactly one probe in flight
+		return true
+	}
+	return false
+}
+
+// Record reports a call outcome. Success closes the breaker; failure counts
+// toward (or re-arms) the open state.
+func (b *Breaker) Record(err error) {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	b.probing = false
+	if err == nil {
+		b.fails = 0
+		return
+	}
+	b.fails++
+	if b.fails >= b.threshold {
+		b.openedAt = b.now()
+	}
+}
+
+// State returns closed | open | half-open for status panels.
+func (b *Breaker) State() string {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	if b.fails < b.threshold {
+		return "closed"
+	}
+	if b.probing || b.now().Sub(b.openedAt) >= b.cooldown {
+		return "half-open"
+	}
+	return "open"
+}