Retry catchup on a clock parked in internal_failure

Resumes a clock parked in internal_failure after a prior catchup error. Catchup is idempotent (only subscriptions with next_billing_at <= frozen_time are processed), so resuming from where the previous attempt stopped is safe; frozen_time keeps the value stamped by the original advance. Asynchronous like advance: the 200 returns the clock back in advancing; poll GET /v1/test-clocks/{id} until status leaves advancing. ADR-018.