fix(ping): confirm a host is down before turning its dot red

[kipavy]

Problem

The reachability dot sometimes turns red on healthy hosts and goes back to green a minute later. A single failed TCP probe set the status to down, and it stayed that way until the next idle probe, 60–75 s later.

Healthy hosts fail one probe regularly:

• Waking from sleep: setInterval freezes during sleep, so on resume every target is overdue and probed at the same moment, often before the network and DNS are back.
• Windows: a lost SYN is retransmitted only after 3 s, which is past the 1.5 s direct-probe budget (that budget also covers name resolution).

Reported on Windows, after sleep, with hosts declared by name.

Fix

• A failed probe keeps the current status and schedules a retry after 7.5 s (DOWN_RETRY_MS).
• The host turns red only once failures span 15 s (DOWN_CONFIRM_MS), which is about 3 failed probes. After that, probing returns to the normal interval.
• One successful probe resets the window and turns the dot green right away.
• Retries stay under ufw limit (6 new connections per 30 s).

Trade-off

A host that is really down turns red about 15 s later than before.

Testing

• confirmDown unit tests in src/services/ping/schedule.test.ts. The ping suite passes (37/37) and tsc --noEmit is clean.
• Not reproduced on Windows. To check by hand: put the PC to sleep for about 10 minutes, wake it, and watch that the dots stay green.