…efore closing circuit

Implements issue ChainForgee#270 (backlog item ChainForgee#62).

Problem: record_success() transitioned HALF_OPEN → CLOSED on the very first
success, risking premature closure after a single lucky probe.

Changes
-------
services/circuit_breaker.py
  - New constructor param success_threshold_in_half_open (default 2).
  - New internal counter _half_open_success_count, reset to 0 whenever
    the breaker enters or re-enters HALF_OPEN (allow_request) and on any
    failure (record_failure).
  - record_success() in HALF_OPEN now increments the counter and only
    transitions to CLOSED once the threshold is reached.
  - record_failure() resets _half_open_success_count before reopening,
    ensuring the next probe window starts from zero.
  - All state transitions remain thread-safe (same Lock).
  - Docstrings updated.

tests/test_circuit_breaker.py
  - test_circuit_breaker_basic_transitions updated: default threshold=2
    means first success stays HALF_OPEN, second closes.
  - TestHalfOpenSuccessThreshold (new class, 6 tests):
      • threshold_3_two_successes_remain_half_open  — AC ChainForgee#1
      • threshold_3_third_success_closes            — AC ChainForgee#2
      • default_threshold_is_2
      • threshold_1_single_success_closes (backward-compat)
      • failure_resets_success_count_and_reopens
      • allow_request_resets_count_on_reentry
  - TestCircuitBreakerMetrics.test_success_closes_circuit_and_resets_state_gauge
    updated to issue two record_success() calls (matches default threshold=2).