M8(1d/3): wire BA_DELIVERD_* into deliverd-* services + document

* docker-compose.yml — add the four M8 retry env
  vars to both deliverd-fcm and deliverd-telegram
  service blocks. Defaults match internal/retry.
  Default() so an operator can omit them. The smoke
  test (M8(2/3)) overrides via BA_DELIVERD_RETRY_*
  to make the DLQ test fast.

* .env.example — added a comment block explaining
  each retry knob and the math behind the defaults
  (10 attempts, base 100ms doubling, cap 2s, budget
  30s ≈ 12s total wall clock for a fully failing
  target).

docker compose config validates.

.env.example

@@ -29,6 +29,23 @@ BA_INGESTD_QUARANTINE_HITS_THRESHOLD=100
 # delivery is fanned out with the final dedupe_count.
 BA_ROUTERD_DEDUPE_FLUSH_MS=2000
 
+# M8: in-process retry knobs shared by deliverd-fcm and
+# deliverd-telegram. See internal/retry/retry.go.
+#  - MAX_ATTEMPTS: total tries including the first
+#  - RETRY_BASE_MS: wait before the SECOND attempt;
+#    doubles each subsequent attempt, capped at MAX_MS
+#  - RETRY_MAX_MS: cap on the per-attempt wait
+#  - RETRY_BUDGET_MS: wall-clock cap across all attempts;
+#    the loop bails early if the next wait would exceed it
+# With the defaults below, a fully-failing target
+# terminates in ~12s — fast enough for the smoke test
+# to be practical, slow enough that transient blips
+# recover cleanly.
+BA_DELIVERD_MAX_ATTEMPTS=10
+BA_DELIVERD_RETRY_BASE_MS=100
+BA_DELIVERD_RETRY_MAX_MS=2000
+BA_DELIVERD_RETRY_BUDGET_MS=30000
+
 # M7: archiver cadence + retention cutoff. The Timescale
 # retention policy does the same at 7d; the archiver just
 # runs ahead so ClickHouse has the data before TS drops it.

docker-compose.yml

@@ -156,6 +156,16 @@ services:
       BA_NATS_URL: nats://nats:4222
       BA_POSTGRES_DSN: postgres://ba:ba@postgres:5432/ba?sslmode=disable
       BA_FAKECMD_URL: "http://fakefcmd:8820"
+      # M8: in-process retry. Defaults match
+      # internal/retry.Default() — 10 attempts, base
+      # 100ms, cap 2s, total budget 30s. Tuned to
+      # terminate in ~12s for a fully failing target
+      # so a single misbehaving source can't tie up a
+      # consumer.
+      BA_DELIVERD_MAX_ATTEMPTS: "10"
+      BA_DELIVERD_RETRY_BASE_MS: "100"
+      BA_DELIVERD_RETRY_MAX_MS: "2000"
+      BA_DELIVERD_RETRY_BUDGET_MS: "30000"
     ports: ["8802:8802"]
     depends_on:
       nats:      { condition: service_healthy }
@@ -172,6 +182,11 @@ services:
       BA_POSTGRES_DSN: postgres://ba:ba@postgres:5432/ba?sslmode=disable
       BA_TELEGRAM_BOT_TOKEN: "fake-tg-bot-token-acme-001"
       BA_TELEGRAM_FAKE_URL: "http://faketgmd:8830"
+      # M8: same retry knobs as deliverd-fcm.
+      BA_DELIVERD_MAX_ATTEMPTS: "10"
+      BA_DELIVERD_RETRY_BASE_MS: "100"
+      BA_DELIVERD_RETRY_MAX_MS: "2000"
+      BA_DELIVERD_RETRY_BUDGET_MS: "30000"
     ports: ["8821:8821"]
     depends_on:
       nats:      { condition: service_healthy }
@@ -227,6 +242,10 @@ services:
       BA_HTTP_ADDR: ":8803"
       BA_NATS_URL: nats://nats:4222
       BA_POSTGRES_DSN: postgres://ba:ba@postgres:5432/ba?sslmode=disable
+      # M8: admind connects to NATS to publish DLQ
+      # replays back onto the deliveries.<chan>.<co>
+      # subject. The HTTPAddr serves /v1/ping, /v1/dlq*,
+      # /dlq, /health, /metrics.
     ports: ["8803:8803"]
     depends_on:
       nats:     { condition: service_healthy }