Distinguish high load and unavailability of TiDB

Development Task

When the load of TiDB is very high, it may not respond within 2 seconds, and thus TiProxy treats it as down and migrates ALL connections away from it. The migration is typically very fast and may finish most of them before the next health check.

If there are 2 TiDB instances, A and B. The CPU usage of A is 100% and B is 90%. Theoretically, this may happen:

• TiProxy can not dial A within 2 seconds and treats A as down and B as alive
• TiProxy wants to migrate all connections from A to B
• After 3 seconds, the CPU usage of A becomes 90% and B becomes 100%
• Again, TiProxy thinks A is alive but B is down
• TiProxy wants to migrate all connections from B to A

This situation is just theoretically possible but I'm not sure if it will happen in the real world:

• If the CPU usage of A is 100%, is it possible to migrate many connections within 3 seconds?
• When the CPU usage of B becomes 100%, it's slow to dial B. Will the connection migration be that fast?

Anyway, the strategies of the health check and router are too aggressive:

• The health check treats the backend as down when it just fails in 2 seconds for 3 times. However, I also want to make the health check fast enough so that the graceful-wait-before-shutdown can be configured shorter.
• The router tries to migrate all connections all at once. Exactly, 10ms for 10 connections and thus 3s for 3000 connections for each TiProxy. 3000 connections almost mean all the connections on one TiDB. However, I also want to make the migration ASAP because it needs to finish within graceful-wait-before-shutdown.

Start by reading the health-check and router implementations, focusing on the 2-second timeout, three failed checks, and all-at-once connection migration described in the issue. Reproduce or reason about the high-load scenarios for two TiDB instances, then define and validate behavior that distinguishes temporary slowness from unavailability without violating graceful-wait-before-shutdown.