Make switchovers/failovers easier

[grischard]

Follow-up from #632 and #621

It should be easier for us to switch/failover automatically if we lose a data centre.

We should define what 'easier means, what kind of reliability we want to achieve, failover times, how we deal with desync issues, etc.

[tomhughes]

It's not hard, it just needs notice so we can schedule it, ideally for a Sunday morning or failing that for a Saturday morning.

[grischard]

See also #120 for just the master DB