failover: retry the same host when no fallback origin exists, and cover the Cloud API hosts

[u9g]

Why

A request to cloud-api.livekit.io was lost between Cloudflare and the origin on 2026-09-11: the edge acknowledged it, no LiveKit system ever saw it, and the client hung until its timeout. The Python SDK's failover could not retry it, for two reasons:

• is_cloud only matches *.livekit.cloud, so a cloud-api.livekit.io request always got exactly one attempt.
• Even with failover engaged, the retry loop raises as soon as pick_next finds no untried origin, which is always the case for cloud-api: it has a single origin and /settings/regions returns 404.

What

Two commits, each test-first:

1. Retry the same host when a retryable failure has no fallback origin. When no untried origin exists, a retryable failure (a transport error or a 5xx) is re-sent to the same origin instead of being raised, until the attempts are exhausted. A transport error can also mean the server executed the request and the response was lost, so treating 5xx differently would buy no idempotency safety, and cross-region failover already retries 5xx. The existing test_region_discovery_unreachable expectation (region 0 failing with 503 every time raises) is preserved: the 503 surfaces once the attempts are exhausted.
2. Enable retries for the LiveKit Cloud API hosts. A new is_cloud_api(host) matches cloud-api.<env>.livekit.io (case-insensitively) and joins is_cloud in failover_attempts. is_cloud itself is unchanged. A Cloud API host has a single origin, so the twirp client never calls region discovery for it; otherwise every failed attempt would also pay the discovery fetch's own timeout.

The existing MIN_FAILOVER_TIMEOUT gate still applies, so requests with a budget under 5 seconds get a single attempt as before.

Behavior change

For cloud-api calls with a budget at or above MIN_FAILOVER_TIMEOUT, a lost request now costs up to FAILOVER_MAX_ATTEMPTS (3) attempts with the existing exponential backoff. A truly dead origin takes up to three times the per-attempt budget to surface instead of one. A single lost request becomes a sub-second blip.

Cross-SDK parity

Mirrors livekit/server-sdk-go#1002, including its review follow-ups. node-sdks has the same design and the same gap; a separate PR will port it there.

Testing

• pytest tests/api -q passes (46 tests) with the livekit/test-server mock running locally, as in the Test API workflow.
• New tests/api/test_failover_unit.py needs no mock server: test_retries_same_host_on_transport_error, test_retries_same_host_on_5xx (both against an in-process aiohttp server with no fallback regions), test_cloud_api_host_never_consults_region_discovery (the server is reached as cloud-api.livekit.io through a loopback resolver and its /settings/regions handler records zero hits), and a test_failover_attempts table with the cloud-api rows. Each was confirmed failing before its implementation commit.
• ruff check and ruff format --check pass with the repo's pinned ruff (0.15.4).

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.