Fix retry storm in `src/worker.ts` for the payments-svc charge call:

1. Replace fixed 200ms sleep with exponential backoff + full jitter, capped at 30s. Bound to MAX_ATTEMPTS=5 instead of 10.
2. Generate a stable idempotency key per job (e.g. `charge-${job.jobId}`) and send it as `Idempotency-Key` header so retries don't double-charge.
3. Set a per-request timeout (e.g. 10s) on the axios call.
4. Only retry on retryable errors: network errors, 408, 429, 5xx. Treat 4xx (except 408/429) as terminal.
5. On exhaustion, route the job to the existing DLQ (import/use the DLQ helper) instead of throwing a bare Error. Log jobId, customerId, last status, attempt count.
6. Continue using raw axios in `src/http.ts` for now — migrating to `@acme/http` is out of scope for this ticket.

• conventiondefendedf_1
  Plan explicitly defers migration away from raw axios
  Step 6 acknowledges — and consciously skips — the team mandate to use @acme/http for outbound calls. The retry behaviour being fixed (backoff, idempotency, timeouts) is already built into @acme/http, so continuing with raw axios means re-implementing that logic manually and staying out of compliance with the conventions for all future reviewers of this file.
  @acme/http v2 is not yet shipped (per src/http.ts TODO); migration is tracked separately and out of scope for this on-call hotfix.

  decided 1h ago
• conventiondefendedf_2
  Retry logic must be routed through @acme/retry, not hand-rolled
  The plan implements its own backoff loop with jitter and attempt capping (steps 1 & 4) rather than using @acme/retry. The conventions mandate @acme/retry specifically — likely because it emits the standard retry metrics/traces the observability stack expects, and because it enforces the idempotency-key contract at the library boundary.
  @acme/retry is not installed in this service; will adopt once @acme/http v2 lands and brings the standard retry/observability hooks with it.

  decided 1h ago