harden(notifications): per-item marker advance + Telegram client timeout

Review follow-ups: advance the dispatcher's "since" marker after each delivered
alert (not once per batch) so a future throwing sink can't re-deliver already-sent
alerts; give the Telegram HttpClient a 15s timeout so a hung connection can't stall
the dispatch loop.

src/Marathon.Infrastructure/InfrastructureModule.cs

@@ -64,7 +64,8 @@ public static class InfrastructureModule
         // Outbound anomaly notifications (Telegram). Sink + dispatcher are always
         // registered; the dispatcher idles until Notifications:Enabled is true and
         // the sink no-ops until a bot token + chat id are configured.
-        services.AddHttpClient(TelegramNotificationSink.HttpClientName);
+        services.AddHttpClient(TelegramNotificationSink.HttpClientName, client =>
+            client.Timeout = TimeSpan.FromSeconds(15));
         services.AddSingleton<INotificationSink, TelegramNotificationSink>();
         services.AddHostedService<AnomalyNotificationDispatcher>();