Stop custom multi-buy backoff from dropping packets for minutes

[macpie]

Every request that was in flight when a custom multi-buy channel died called inc_backoff separately, so one dropped connection doubled the delay once per failed request. Eight concurrent failures walked the window from 1s to over two minutes, and on a route with fail_on_unavailable set that meant every packet was dropped for the whole time. None of it was visible either: the backoff short-circuit and the cold-channel path emitted no metrics, so a route dropping everything looked the same as a route with no traffic.

• Escalate the backoff once per window instead of once per failed request.
• Cap the window at 60s for routes that fail closed. Dropping every packet is a heavy penalty and shouldn't ride the 5 minute ceiling meant for routes that fall back to local counting.
• Let a single probe through when a window expires and hold the rest back until it reports, so a service that is still down costs one call rather than one per packet. The hold expires on its own, so a probe that never answers can't wedge the route.
• Count every decision in hpr_multi_buy_decision_counter, including the drops that were previously silent.
• Stop the grpc channel and clear its backoff entry when a route is removed or repointed at a different host, instead of leaking both for the life of the node.