degrade gracefully when one service has stale credentials

Periodics previously required all service credentials to be healthy before
running. A single expired Airbnb session would silence all Booking.com work.

Gate probe_once's run_due call on store_ok only. Per-service is_stale()
fast-fail and _gather() exception isolation already ensure a failing service
returns None without affecting the others — no changes to those paths needed.

room_cal/_health.py

@@ -81,7 +81,7 @@ async def credentials_checks(api: ServiceAPI | None = None) -> dict[str, HealthR
 
 
 async def probe_once() -> None:
-  """Run one health probe, update the cache, and dispatch periodic work if all-green."""
+  """Run one health probe, update the cache, and dispatch periodic work when the store is healthy."""
   global _cached
   periodic_disabled = bool(os.getenv('DISABLE_PERIODIC'))
   try:
@@ -104,7 +104,10 @@ async def probe_once() -> None:
       },
       'checked_at': datetime.now(timezone.utc).isoformat(),
     }
-    if store_ok and creds_ok and not periodic_disabled:
+    # Run periodics whenever the store is healthy, even if some services have stale
+    # credentials. Per-service error isolation in _gather() and is_stale() ensures
+    # that a failing service degrades gracefully without blocking the healthy ones.
+    if store_ok and not periodic_disabled:
       from room_cal._periodic import run_due, _register_all_periodics
       _register_all_periodics()
       await run_due(api)