Filter update retries jump to one hour and then grow without bound

### Problem

When a periodic filter update fails because of a network error,
`periodicallyRefreshFilters` updates the retry interval with:

```go
ivl *= 2
ivl = max(ivl, maxInterval)
```

With `maxInterval = time.Hour`, the first retry jumps from five seconds
directly to one hour. Once the interval reaches an hour, later failures
increase it to two hours, four hours, and so on instead of capping it.

### Impact

A temporary network problem can leave filter lists stale for much longer than
intended, even after connectivity returns.

### Expected behavior

Use exponential backoff capped at one hour:

- 5 s → 10 s
- 45 min → 1 h
- 1 h → 1 h

### Proposed fix

Replace the lower-bound operation with an upper bound for the doubled
interval. This is a focused one-token production change with no API or
configuration changes.

I have a deterministic test using a controlled HTTP transport that fails on
the current implementation and verifies both doubling and the one-hour cap.
Local validation of the proposed change included:

- the focused race-enabled test repeated 20 times;
- the full filtering package under the race detector;
- `go vet`;
- `make go-check`;
- Linux and Windows compile checks.

If this scope looks acceptable, I can send the focused patch and regression
test as a separate PR.