Implement expiry state computation logic

Extract `computeExpiryState` as a standalone pure function or static method on a `CertificationExpiryCalculator` utility class to make it independently testable without instantiating the full service. Accept an optional `DateTime Function() clock` parameter defaulting to `() => DateTime.now().toUtc()` so tests can inject a fixed time. The 30-day threshold should live in `lib/core/constants/certification_constants.dart`. When the BLoC maps certifications to UI state, it should call `computeExpiryState` on each item rather than storing the computed status in the database — computed status is derived, not stored, to avoid stale reads.

However, the `updateExpiryStatus` repository method should persist the last-computed status as a cache for server-side batch queries (Bufdir reporting, auto-pause triggers).

Write exhaustive unit tests for `computeExpiryState` covering: (1) expiry date exactly equal to now (expired), (2) expiry date one second in the past (expired), (3) expiry date one second in the future (expiring_soon, within 30 days), (4) expiry date exactly 30 days from now (expiring_soon), (5) expiry date 30 days and one second from now (valid), (6) expiry date one year in the future (valid), (7) null expiresAt (expected behaviour per team decision). Use a `FakeClock` or inject a `DateTime Function()` clock provider to make the function deterministic in tests — never call `DateTime.now()` directly inside the pure function. Verify that the CertificationStatus enum is not redefined anywhere else in the codebase.