Pass-rate regression alert

Compares today's pass rate against a trailing baseline window's average, only when both windows have enough sample volume to be statistically meaningful (skipped below a configured minimum sample size in either window, to avoid noisy alerts on a low-traffic domain). A regression here can be the first sign of a broken SPF/DKIM change before the underlying cause shows up as a specific recommendation.