pub fn backoff_ms(attempt: u32, base: u32, max: u32) -> u32
Pure exponential backoff: min(max, base << attempt) with saturation.
min(max, base << attempt)