Extracts upstream timeout resolution into selectUpstreamTimeout(req)
so the policy is explicit and testable:

- defaultUpstreamTimeout (used when the per-URN config sets timeout=0)
  raised from 3s to 15s to match the production upstream config.
- broadcastMinimumTimeout introduced at 15s: any broadcast_transaction*
  request always gets at least 15s regardless of config. A 3s clip on a
  synchronous broadcast surfaces to wallets as
  transaction_expiration_exception once the caller retries with a fresh
  expiration, even though the original tx already made it into a block.

The existing callHTTPUpstream now delegates to selectUpstreamTimeout
instead of inlining the timeout-or-default branch.

Test coverage:
- Table-driven selectUpstreamTimeout cases for non-broadcast / broadcast,
  config 0 / sub-minimum / above-minimum, both broadcast methods.
- Safety assertion that both constants stay above one block-confirmation
  window (10s) so future refactors can't silently shrink them.

Three orthogonal improvements that together close the gap between the Go
rewrite and the legacy Python jussi behaviour observed by wallets during
upstream steemd incidents:

1. Selective upstream retry (internal/upstream/retry.go,
   HTTPClient.RequestWithRetry, processor.callHTTPUpstream)

   Commit 9cf36ea removed all upstream retry to fix a different bug
   (retry-induced expiration), but this also removed legacy's implicit
   tolerance for transient ALB/steemd blips on read paths. Idempotent
   methods now retry up to 2 attempts with 100ms→500ms backoff + 25%
   jitter on retriable failures (connection reset, EOF, i/o timeout,
   HTTP 5xx). Non-retriable errors (context cancel/deadline, 4xx)
   short-circuit immediately. broadcast_transaction* methods are still
   single-attempt — a retry could submit the same tx twice.

   The retry budget is intentionally tighter than legacy (≤2 vs 3
   attempts, ≤500ms vs 5s backoff) so the worst-case retry tail stays
   well under typical wallet timeouts, avoiding the issue 9cf36ea fixed.

2. Broadcast minimum timeout 15s → 30s
   (internal/handlers/processor.go const broadcastMinimumTimeout)

   Production broadcast_synchronous traces show p95 wall time of ~3s
   (one block confirmation), but ALB-fronted steemd nodes can hang
   ≥15s during fork/restart windows. The 15s floor was clipping these
   recoverable cases. 30s covers ~10 blocks of upstream slowness while
   still bounding wallet response time. Production upstream config in
   the orchestration repo is updated in a parallel commit.

3. Observability for upstream config and broadcast errors
   (Router.logConfigSummary, selectUpstreamTimeout throttled log,
   processor.ProcessRequest broadcast-error structured log)

   - At startup each upstream emits one INFO line with its parsed URL
     count, translate_to_appbase flag, namespace timeout, and broadcast
     timeout — operators can verify "the config I shipped is the config
     that's running" in one glance.
   - selectUpstreamTimeout emits a throttled (1/method/minute) INFO log
     when the broadcast floor actually overrides a smaller configured
     value, surfacing config drift without log-spam.
   - Broadcast upstream errors emit a structured WARN log with method,
     namespace, upstream URL, jussi_request_id, and the upstream error
     message — the signal operators need to correlate "wallets seeing
     failed broadcasts" with an upstream incident, without paging
     through individual jaeger traces.

Test coverage
- internal/upstream/retry_test.go: IsRetriableUpstreamError truth table
  (15 cases incl. context cancel, wrapped errors, 5xx vs 4xx), backoff
  exponential-with-cap, jitter bounded-and-positive, default config
  safety assertion (worst-case budget ≤ 2s).
- internal/upstream/http_retry_test.go: httptest-backed RequestWithRetry
  covering success-after-transient-500, no-retry-on-4xx,
  give-up-after-max-attempts, context-cancellation-stops-loop.
- internal/handlers/processor_timeout_test.go: extended for the 30s
  floor (sub-minimum, equal-to-minimum, above-minimum, previous-15s
  raised to new 30s).

…log throttle

- Replace string-matching 5xx detection with UpstreamStatusError type
- Switch broadcast method detection from map to prefix match (broadcast_*)
- Make shouldLogBroadcastFloor concurrency-safe with CompareAndSwap/LoadOrStore
- Add nil-guard for req.URN in selectUpstreamTimeout
- Expand tests for edge cases and concurrent log throttling