Steadier outage and recovery alerts

A monitor now needs two good checks in a row before it is marked as recovered, matching the two failed checks it takes to mark it down. A flapping site no longer sends a down and up pair on every blip.

After the first failed or first good check we re-check within about 60 seconds, so even monitors that normally run once a day confirm an outage or recovery in around a minute. Repeat down alerts have a 5-minute cooldown by default, and a recovery notice always goes to the channels that received the matching down alert.