CB-578 stage B: quarantine the exhausted credential, not the profile

A BACKEND_EXHAUSTED classification (stage A) now puts that profile's
credential into a BackendQuarantine for a configurable cooldown. A spawn
onto a quarantined profile is refused naming the credential and roughly
when it lifts; weighted/round-robin/fixed placement skip a quarantined
candidate; the quarantine lifts itself on the injected clock; and it is
visible on bridge_profiles.

Keyed by credential, not by profile name, via the new Profile.credentialId
(profiles sharing one credential quarantine together — e.g. two models on
one account) and effectiveCredentialId() (unset ⇒ quarantines alone,
today's behaviour unchanged). Fixed a related gap along the way: a reload
changing exhaustedPattern was silently reported "applied" even though it's
deferred — sameLaunchSettings() now catches it too.

bridged/src/test/java/dev/ltms/bridged/placement/PlacementPolicyTest.java

@@ -24,7 +24,13 @@ class PlacementPolicyTest {
     private static PlacementContext ctx(List<PlacementCandidate> candidates,
                                         Function<String, Integer> liveCount,
                                         Set<String> unreachable) {
-        return new PlacementContext("b", candidates, liveCount, unreachable);
+        return ctx(candidates, liveCount, unreachable, Set.of());
+    }
+
+    private static PlacementContext ctx(List<PlacementCandidate> candidates,
+                                        Function<String, Integer> liveCount,
+                                        Set<String> unreachable, Set<String> quarantined) {
+        return new PlacementContext("b", candidates, liveCount, unreachable, quarantined);
     }
 
     private static PlacementContext ctx(List<PlacementCandidate> candidates,
@@ -46,17 +52,37 @@ class PlacementPolicyTest {
         PlacementPolicy policy = PlacementPolicies.fixed();
         PlacementContext ctx = new PlacementContext(null,
                 List.of(PlacementCandidate.profile("a"), PlacementCandidate.profile("b")),
-                noSessions(), Set.of());
+                noSessions(), Set.of(), Set.of());
         assertEquals("a", policy.select(ctx).profile());
     }
 
     @Test
     void fixedThrowsWhenNoProfilesAndNoDefault() {
         PlacementPolicy policy = PlacementPolicies.fixed();
-        PlacementContext ctx = new PlacementContext(null, List.of(), noSessions(), Set.of());
+        PlacementContext ctx = new PlacementContext(null, List.of(), noSessions(), Set.of(), Set.of());
         assertThrows(PlacementException.class, () -> policy.select(ctx));
     }
 
+    @Test
+    void fixedSkipsQuarantinedDefault() {
+        PlacementPolicy policy = PlacementPolicies.fixed();
+        PlacementContext ctx = new PlacementContext("b",
+                List.of(PlacementCandidate.profile("a"), PlacementCandidate.profile("b")),
+                noSessions(), Set.of(), Set.of("b"));
+        assertEquals("a", policy.select(ctx).profile(),
+                "the default 'b' is quarantined, so fixed falls through to the first un-quarantined candidate");
+    }
+
+    @Test
+    void fixedThrowsWhenDefaultAndEveryCandidateQuarantined() {
+        PlacementPolicy policy = PlacementPolicies.fixed();
+        PlacementContext ctx = new PlacementContext("b",
+                List.of(PlacementCandidate.profile("a"), PlacementCandidate.profile("b")),
+                noSessions(), Set.of(), Set.of("a", "b"));
+        PlacementException e = assertThrows(PlacementException.class, () -> policy.select(ctx));
+        assertTrue(e.getMessage().contains("quarantined"), e.getMessage());
+    }
+
     @Test
     void roundRobinCyclesThroughAvailableProfiles() {
         PlacementPolicy policy = PlacementPolicies.roundRobin();
@@ -82,6 +108,18 @@ class PlacementPolicyTest {
         }
     }
 
+    @Test
+    void roundRobinSkipsQuarantinedProfiles() {
+        PlacementPolicy policy = PlacementPolicies.roundRobin();
+        List<PlacementCandidate> candidates = List.of(
+                PlacementCandidate.profile("a"),
+                PlacementCandidate.profile("b"));
+        PlacementContext ctx = ctx(candidates, noSessions(), Set.of(), Set.of("a"));
+        for (int i = 0; i < 5; i++) {
+            assertEquals("b", policy.select(ctx).profile(), "a is quarantined, so every pick lands on b");
+        }
+    }
+
     @Test
     void roundRobinThrowsWhenAllAtMaxLoad() {
         PlacementPolicy policy = PlacementPolicies.roundRobin();
@@ -150,6 +188,29 @@ class PlacementPolicyTest {
         assertTrue(e.getMessage().contains("maxLoad"), e.getMessage());
     }
 
+    @Test
+    void weightedSkipsQuarantinedProfile() {
+        PlacementPolicy policy = PlacementPolicies.weighted();
+        List<PlacementCandidate> candidates = List.of(
+                PlacementCandidate.profile("a", 1.0f, null),
+                PlacementCandidate.profile("b", 1.0f, null));
+        PlacementContext ctx = ctx(candidates, noSessions(), Set.of(), Set.of("a"));
+        for (int i = 0; i < 5; i++) {
+            assertEquals("b", policy.select(ctx).profile(), "a is quarantined, so every pick lands on b");
+        }
+    }
+
+    @Test
+    void weightedThrowsWhenAllQuarantined() {
+        PlacementPolicy policy = PlacementPolicies.weighted();
+        List<PlacementCandidate> candidates = List.of(
+                PlacementCandidate.profile("a"),
+                PlacementCandidate.profile("b"));
+        PlacementException e = assertThrows(PlacementException.class,
+                () -> policy.select(ctx(candidates, noSessions(), Set.of(), Set.of("a", "b"))));
+        assertTrue(e.getMessage().contains("quarantined"), e.getMessage());
+    }
+
     @Test
     void weightedThrowsWhenAllUnreachable() {
         PlacementPolicy policy = PlacementPolicies.weighted();