Implement auto-pause trigger on certification expiry

Implement idempotency at the `PauseManagementService` layer using an `INSERT ... ON CONFLICT DO NOTHING` upsert in Supabase rather than a check-then-insert pattern. In `CertificationManagementService`, the sequence after detecting expiry should be: (1) update certification status in repository, (2) call `autoPauseMentor`, (3) emit pause event for notification delivery. Steps 2 and 3 are fire-and-handle-error — a failure does not undo step 1.

For the Supabase Edge Function batch job, implement a scheduled Deno function (`check-certification-expiry`) that runs nightly via pg_cron or Supabase scheduled functions. The Edge Function queries all certifications where `expires_at < now()` and `status != 'expired'`, calls the same pause logic server-side, and logs each action to the audit table. This ensures certifications are caught even when the mobile client has not been opened.

Unit tests: (1) verify `autoPauseMentor` is called when status is `expired`, (2) verify it is NOT called for `valid` and `expiring_soon`, (3) verify idempotency — mock PauseManagementService to return a 'already paused' response and assert no exception is thrown and no duplicate record is created, (4) verify that a PauseManagementService failure does not roll back the expiry status update. Integration test: seed a mentor with an expired certification, run the expiry check twice, assert exactly one pause record exists in the database. Edge Function test: trigger the nightly batch via Supabase CLI and assert pause records are created for all expired mentors without duplicates.