Implement notification deduplication against cert_notification_log

Build the in-memory lookup as a Set where each element is the composite key formatted as '${mentorId}|${expiryDate.toIso8601String().substring(0,10)}|${thresholdDays}|${certType.name}'. This O(n) build + O(1) lookup pattern is far more efficient than nested iteration for large batches. The 90-day cutoff should be a const at the top of the service (const _logRetentionDays = 90) applied in the SQL WHERE clause via CertificationRepository, not filtered in Dart memory. Implement fail-closed by wrapping the repository call in a try/catch that re-throws as DeduplicationQueryException — never silently return the full unfiltered list on error, as this would result in notification spam.

The separation of concerns here is critical: this method only reads and filters; it never writes. Writing to the log is task-011's responsibility, which prevents double-write races if the service is later parallelised.

Unit tests (flutter_test): (1) Seed mock log with a delivered entry for (mentor-A, expiry-date-X, 7 days); assert mentor-A excluded from result. (2) Seed mock log with a failed entry for the same tuple; assert mentor-A IS included (retry allowed). (3) Seed log with an entry older than 90 days; assert candidate is NOT excluded (stale log). (4) Assert two certifications of different cert_types for the same mentor are deduped independently.

(5) Mock CertificationRepository.getNotificationLog throwing an exception; assert DeduplicationQueryException is thrown and no candidates pass through. (6) Assert batched query is called once regardless of input list size (mock call count assertion). (7) Empty input list returns empty list without database call. Coverage target: 95% branch coverage.