issue 800: fix review round 1 findings in mesh-mail-notifier

Flush now sorts accounts instead of walking a map, so notice order is
stable. A failed node-notifier.send keeps its mail pending and retries
at most once a minute, without holding up other accounts' notices, and
the failure is kept in the Store for a new health tool
(mail_notifier_health) that is unhealthy past ten minutes of failure.
The burst rule now follows the lead's reading of ADR 0378 S9: within an
account's sliding minute, the first three qualifying mails are shown
one by one and the rest are folded into one notice at the window's
end; there is no separate quiet-gap timer. The dedupe key is the
account and message id, falling back to folder/uidvalidity/uid only
when no message id is given, so a UIDVALIDITY reset cannot suppress a
new mail, and a redelivered event already buffered is never recounted.
status now lists every granted account, not only those with a notice,
and caches mail-store.accounts for a minute.

modules/mesh-mail-notifier/module.json

@@ -26,7 +26,8 @@
     }
   ],
   "tools": [
-    "mail-notifier.status"
+    "mail-notifier.status",
+    "mail_notifier_health"
   ],
   "own-secrets": {
     "broker": "${dir:state}/broker"
@@ -57,7 +58,12 @@
         "notify"
       ],
       "health": {
-        "kind": "unit"
+        "kind": "tool",
+        "tool": "mail_notifier_health",
+        "interval": "60s",
+        "timeout": "10s",
+        "looks": 2,
+        "grace": "120s"
       }
     }
   ],