Failed Transaction Retry Queue

If the accounting service is offline, the posting isn't lost. Each failure is written to a per-tenant queue and retried with exponential backoff (5 min → 20 min → 1 hr → 4 hr → 12 hr). It's event-driven, so there's zero overhead when accounting is healthy, and the core billing or payment operation is never blocked.