fix: pack backoff runs from the failure

#239 moved §5.7's attention window to `failed_at` and left §6.2's pack
ladder on `grabbed_at`. A torrent that stalls for weeks before ffprobe
condemns it at import has elapsed the whole ladder the moment it fails,
so the pack lane retried a source that had just failed — the one thing
the backoff exists to prevent.

The ladder now measures from the failure, the same anchor and the same
column §5.7 reads, with `grabbed_at` as the fallback for rows written
before the column existed. All three sites read
`max(coalesce(failed_at, grabbed_at))`, so the `last_failed_at` alias
holds what its name says — including the one the season deck feeds into
`reopens_at` and `pack_retry_at`, which was showing a grab time under a
name §5.7 had redefined.

DESIGN.md §6.2 states the anchor the way §5.7 states its own.

Tests cover a pack grabbed 35 days ago and failed 10 minutes ago on the
targeted lane, the RSS lane and the season deck.

`just ci` through the gate: 519/519 tests pass, web checks clean.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

DESIGN.md

@@ -480,6 +480,22 @@ its own, the escape hatch is the season release deck, not a lane exception.
 Targeted search backs off `1h → 6h → 1d → 3d`, capped at 7d, reset when the
 title's metadata changes. It never gives up entirely, it goes quiet.
 
+**The ladder runs from the failure, not the grab.** A failed season-pack grab
+quiets the pack lane on that same curve, and the rung is measured from the
+moment the grab entered `failed` — `grabs.failed_at`, the column §5.7's
+attention window reads — not from when it was sent. The two are usually
+minutes apart, but a torrent can stall on a dead swarm for five weeks before
+`ffprobe` condemns it at import. Measured from the grab, the whole ladder has
+already elapsed by the time the failure lands, so the lane retries the source
+that just failed at once, which is the one thing the backoff exists to
+prevent. The ladder's job is to stay off a source that has recently failed,
+and "recently" can only mean recently failed.
+
+One anchor covers both features. §5.7's window and this ladder ask the same
+question of the same event and read the same column; a target still broken
+keeps producing fresh failures, and each one both re-arms this backoff and
+holds the target in the attention queue.
+
 **Do not search before the release exists.** TMDB carries release dates; a
 movie with no digital release date gets zero targeted searches. This is the
 single largest source of wasted queries in Radarr and it is free to avoid.