Wire PauseManagementService certification integration points

Add pause-related columns to peer_mentors if they don't exist: is_paused (boolean, default false), pause_reason (text, nullable), paused_at (timestamptz, nullable), paused_by (uuid, nullable). Alternatively, use a dedicated peer_mentor_pauses table for full audit history — prefer this approach if multiple pause periods need to be tracked over time. Inject PushNotificationService into SupabasePauseManagementService via Riverpod so it can send coordinator notifications without tight coupling. Define a clear contract in the abstract class's doc comments specifying which exceptions are thrown and when.

The triggerAutoPauseOnCertificationExpiry method should be the single entry point for all certification-driven pauses — avoid calling pauseMentor directly from the certification service. The HLF organisation requirement states that an expired certificate should remove the mentor from the local branch website automatically — document this as a downstream effect of the pause status that the visualisation/website integration must listen for via Supabase Realtime.

Unit tests (flutter_test with mocked Supabase and mocked PushNotificationService): (1) pauseMentor with certificationExpired reason updates pause status and triggers a coordinator notification; (2) isMentorPaused returns true after pause and false after resume; (3) double-calling pauseMentor is idempotent (does not throw, does not create duplicate audit entries); (4) resumeMentor clears the pause reason and updates pausedAt to null; (5) triggerAutoPauseOnCertificationExpiry delegates to pauseMentor with the correct PauseReason. Integration test: create a certification, expire it, call triggerAutoPauseOnCertificationExpiry, and assert the database row reflects the paused state. Verify the coordinator notification is sent exactly once (check idempotency via cert_notification_log).