Timeouts, retries, health checks, graceful failure

Make every external call safe: timeouts everywhere, limited retries with back-off, a circuit breaker that stops calling a failing provider for a while, health and readiness endpoints, and a friendly fallback reply instead of a crash. Practise one failure on purpose (provider down, database slow) and check the system degrades gracefully and alerts fire.