Use one recovery routine at start and on every sweep tick (closes #542)

Start-up recovery and the 60-second sweep were two parallel sets of
functions doing the same job. recoverDeliveries now does it, run once at
start and then on every tick from one goroutine. A retrying delivery is
scheduled after what is left of its backoff, now if nothing is left, so
backoffElapsed is gone. The run at start still takes every pending
delivery and opens a webhook database whose file is missing; a tick
still takes only pending deliveries untouched for 15 minutes, at most
500, and skips a missing file. A retrying delivery is taken before its
event is read. The README describes one routine.

Model: opus-5-5

internal/database/event_tier_indexes_test.go

@@ -79,8 +79,9 @@ func TestEventTierQueriesUseTheirIndexes(t *testing.T) {
 	byStatus := "idx_deliveries_status (status=? AND deleted_at=?)"
 	byEvent := "idx_deliveries_event_id (event_id=? AND deleted_at=?)"
 
-	// The delivery engine: recovery and the retry sweep, the sweep for
-	// stranded pending deliveries, and the queue depth count.
+	// The delivery engine: the recovery routine, which reads the
+	// retrying deliveries and, on a tick of the sweep, the pending ones
+	// untouched for a while; and the queue depth count.
 	assertPlanUses(t, db, dry.Where(
 		"status = ?", database.DeliveryStatusRetrying,
 	).Find(&deliveries), byStatus)

internal/database/retention.go

@@ -184,8 +184,9 @@ func (r *RetentionReaper) sweep(ctx context.Context) {
 
 		wh := webhooks[i]
 
-		// A missing database has nothing to reap. Restart recovery
-		// reports a lost one (see WebhookDBManager.GetDB).
+		// A missing database has nothing to reap. The delivery
+		// engine's recovery routine reports a lost one at start (see
+		// WebhookDBManager.GetDB).
 		if !r.dbManager.DBExists(wh.ID) {
 			continue
 		}