efba5ceb9c
The CircuitBreakerMiddleware was blocking all requests (503 circuit_open) because every exception in get_db() — including 401 Unauthorized, 403 Forbidden, 404 Not Found — was calling record_failure() on the DB circuit breaker. This caused the circuit to trip after 5 non-DB errors (e.g. failed login attempts during security testing). Fix: Only call record_failure() when _is_transient_db_error(exc) returns True, filtering out HTTP exceptions that are not DB-related.