Add configurable retry backoff before dead-lettering

[nabisobhi]

Problem

When a dead letter queue is configured with WithMaxRetries(n), retries currently happen in a tight loop with no delay. A transient failure (DB timeout, downstream 503) gets hammered n times within microseconds, which neither gives the dependency time to recover nor relieves any pressure on it.

Change

Two new options on DeadLetterQueueOptions:

options.WithDeadLetterQueue("orders.dead-letter")
       .WithMaxRetries(3)
       .WithExponentialRetryBackoff(TimeSpan.FromSeconds(1), factor: 2.0,
                                    maxDelay: TimeSpan.FromSeconds(30));

// or a fixed delay
options.WithDeadLetterQueue().WithMaxRetries(3)
       .WithRetryBackoff(TimeSpan.FromSeconds(5));

The delay before retry attempt n (first retry = 1) is initialDelay * factor^(n-1), optionally capped by maxDelay. When neither option is configured the behavior is unchanged — no delay — so this is opt-in.

Internally the policy resolves to a Func<int, TimeSpan> (null = no delay), threaded through ConsumerConfigurationBuilder → ConsumerConfiguration → Consumer, following the same path as the existing MaxRetries. Both AddConsumer overloads are wired.

Cancellation

The delay is awaited as Task.Delay(delay, cancellationToken) from inside the catch block, so cancelling during a backoff propagates OperationCanceledException rather than being re-caught and dead-lettered. The message is neither dead-lettered nor committed on shutdown, so it is redelivered. Covered by a test.

Timer limit

Worth a look during review: the first commit clamped exponential overflow to TimeSpan.MaxValue, but Task.Delay throws ArgumentOutOfRangeException beyond the platform timer limit. Since the delay is awaited inside the catch block, that would have crashed the consumer with a confusing argument error instead of backing off — reachable from plain WithExponentialRetryBackoff(1s, 2.0) with a high maxRetries, or directly via WithRetryBackoff(TimeSpan.FromDays(60)).

Delays are now validated and clamped to MaxSupportedRetryDelay (int.MaxValue ms ≈ 24.8 days), with an explicit maxDelay still winning when smaller. A double.IsNaN guard also prevents a negative TimeSpan when a zero initial delay is combined with an overflowing factor (0 * ∞).

No longer stacked

This PR was originally stacked on #353 (dead letter queue bypass). That has since merged, so the diff is now against master and shows only the backoff change.

Because #353 landed as a squashed commit whose contents had evolved during its own review, merging master in conflicted across every file. The resolution keeps master's version of the bypass feature — including the snapshotted BypassPredicate and the expanded XML docs — and re-applies the backoff on top. The merged diff against master is additive apart from the lines the backoff change legitimately modifies.

Notes

• No new NuGet dependencies.
• Public API is additive only — no signature or behavior changes to existing members, so this stays on the 2.1.0 line.
• Bypass and diagnostics code untouched.

Tests

TestDeadLetterQueueOptions gains coverage for the delay sequences, factor, maxDelay precedence, validation errors, the overflow clamp and the NaN/zero case; plus consumer-level tests for delay ordering, attempt numbering and cancellation. No wall-clock assertions — the backoff function is faked and its attempt arguments recorded, so the tests stay fast and non-flaky.

Full suite: 181 passed, 0 failed. Build clean, 0 warnings.