fix(watcher): a create answered 201 when nothing had been written

`persistNow` caught the write error, logged it, and returned as though it had
worked. `POST /invoices` awaited it and answered 201 regardless, so the merchant
filed an order against an invoice that lived in one process and nowhere else. A
restart erases it, the payer pays anyway, and the money lands on an address
nothing is watching. The comment beside that log already said the stakes:
"Losing it means a paid invoice can never be matched back to an order." It only
ever told the terminal.

Found by an audit run whose store path happened to be unwritable. The log line
scrolled past while the API kept answering 201.

- persistNow records whether the write landed.
- POST /invoices refuses with 503 when it did not, removes the row it was about
  to lie about, and frees the id so a retry works.
- GET /status, behind the token, reports whether the ledger is writable and
  answers 503 itself so a monitor can watch it.
- /healthz is unchanged and still says only that the process is answering. Its
  existing test asserts the exact body, and it caught me widening it: whether a
  merchant's ledger is healthy is not a stranger's business.

Five tests, run against two watchers, one with a store it can write and one
whose store path has a file where a directory should be. No stub, no test-only
setter on the server: the failure came from a filesystem, so a filesystem
produces it. Restoring either half of the old behaviour fails two and three of
them respectively.

205 tests pass.