Replace the egress recovery timer with a scheduled job (#3937)

A failed check still calls assessAfterFailure, which now shares one
in-flight assessment between concurrent failures (same cache shape as
ProxyResolver). When egress degrades it upserts a global "egress" job;
DBQueueWorker runs checkRecovery for that type at the configured
interval, and the job deletes its own row once any target answers.
The unref'd timer, startRecoveryPolling, stop and init are gone: a
degraded episode survives a restart through the jobs collection.
deleteByIdAndType accepts a null refId for global rows.

🔧

server/src/config/services.worker.ts

@@ -106,7 +106,7 @@ export const buildWorker = async (shared: SharedServices, envSettings: EnvConfig
 	const bufferService = new BufferService(logger, checkService, geoChecksService, dockerLogsService, settingsService, jobsRepository);
 	const statusService = new StatusService(logger, monitorsRepository, monitorStatsRepository);
 	const monitorStatusPolicy = new MonitorStatusPolicy();
-	const egressService = new EgressService(settingsService, egressStateRepository, networkService, logger);
+	const egressService = new EgressService(settingsService, egressStateRepository, jobsRepository, networkService, logger);
 
 	// ***********************
 	// Reactors and dispatcher
@@ -165,6 +165,7 @@ export const buildWorker = async (shared: SharedServices, envSettings: EnvConfig
 		geoCheckPipeline,
 		dispatcher: reactorDispatcher,
 		helper: workerHelper,
+		egressService,
 		queueWorkersRepository,
 		queueMode: envSettings.queueMode,
 		queuePrimaryProcesses: envSettings.queuePrimaryProcesses,
@@ -189,8 +190,5 @@ export const buildWorker = async (shared: SharedServices, envSettings: EnvConfig
 		});
 	}
 
-	// Resume recovery polling if the instance was mid-episode when it last stopped
-	await egressService.init();
-
 	return { worker, networkService, bufferService, statusService, egressService };
 };