Re-notify on persistent watch_error after configurable silence window

[gregoryfoster]

Problem

watch_error fires once on first fetch failure and is then silent until recovery. If a watch stays down permanently (site gone, domain expired), the user receives one notification and then silence. There is no mechanism to re-alert after a configurable period.

Proposed approach

Add a last_error_notified_at timestamp to Watch (nullable). In check_watch:

• On fetch failure: if health_status is already ERROR and last_error_notified_at is older than the re-notify interval, fire watch_error again and update the timestamp
• On recovery: clear last_error_notified_at

Re-notify interval could be per-watch via schedule_config (e.g. error_renotify_interval: "24h") with a system default fallback.

Acceptance criteria

• Re-notification fires after configurable silence window when still in ERROR state
• Recovery clears the re-notification state
• Interval configurable per-watch; system default if not set
• Covered by unit tests