Persist verificationId for staff certificates

Add support for verificationId throughout the certificate flow: schema, GraphQL mutations/queries, domain, repositories, service implementation, and UI.

- Backend: add verificationId to Certificate schema and include it in upsert/create mutations; add auth insecureReason notes to related connector operations.
- Data layer: add verificationId parameter to StaffConnectorRepository API and propagation in implementation (SDK call remains commented with FIXME until dataconnect SDK is regenerated).
- Domain: add verificationId field to StaffCertificate (constructor, copyWith, props).
- Certificates flow: create verification via verificationService, pass returned verificationId to upsertStaffCertificate so the verification record is persisted with the certificate.
- UI: update certificate upload page to show existing file path, disable editing of name/issuer/number, rearrange fields, move remove button, change file icon and text style.
- Misc: minor lambda formatting cleanup in benefits mapping.

Note: the generated dataconnect SDK must be refreshed to enable the new .verificationId(...) call (there is a commented FIXME in the connector implementation).

backend/dataconnect/connector/application/queries.gql

@@ -451,7 +451,7 @@ query vaidateDayStaffApplication(
   $limit: Int
   $dayStart: Timestamp
   $dayEnd: Timestamp
-) @auth(level: USER) {
+) @auth(level: USER, insecureReason: "The staffId refers to the staff being validated. Ownership is verified at the application layer.") {
   applications(
     where: { 
       staffId: { eq: $staffId } 

backend/dataconnect/connector/certificate/mutations.gql

@@ -10,7 +10,7 @@ mutation CreateCertificate(
   $staffId: UUID!
   $validationStatus: ValidationStatus
   $certificateNumber: String
-) @auth(level: USER) {
+) @auth(level: USER, insecureReason: "The staffId refers to the staff being modified. Ownership is verified at the application layer.") {
   certificate_insert(
     data: {
       name: $name
@@ -40,7 +40,7 @@ mutation UpdateCertificate(
   $issuer: String
   $validationStatus: ValidationStatus
   $certificateNumber: String
-) @auth(level: USER) {
+) @auth(level: USER, insecureReason: "The staffId refers to the staff being modified. Ownership is verified at the application layer.") {
   certificate_update(
     key: { staffId: $staffId, certificationType: $certificationType }
     data: {
@@ -58,7 +58,7 @@ mutation UpdateCertificate(
 }
 
 mutation DeleteCertificate($staffId: UUID!, $certificationType: ComplianceType!)
-@auth(level: USER) {
+@auth(level: USER, insecureReason: "The staffId refers to the staff being modified. Ownership is verified at the application layer.") {
   certificate_delete(
     key: { staffId: $staffId, certificationType: $certificationType }
   )
@@ -88,7 +88,8 @@ mutation upsertStaffCertificate(
   $issuer: String
   $certificateNumber: String
   $validationStatus: ValidationStatus
-) @auth(level: USER) {
+  $verificationId: String
+) @auth(level: USER, insecureReason: "The staffId refers to the staff being modified. Ownership is verified at the application layer.") {
   certificate_upsert(
     data: {
       staffId: $staffId
@@ -100,6 +101,7 @@ mutation upsertStaffCertificate(
       issuer: $issuer
       certificateNumber: $certificateNumber
       validationStatus: $validationStatus
+      verificationId: $verificationId
     }
   )
 }

backend/dataconnect/schema/certificate.gql

@@ -44,6 +44,7 @@ type Certificate @table(name: "certificates", key: ["staffId", "certificationTyp
   certificateNumber: String 
   
   validationStatus: ValidationStatus
+  verificationId: String
 
   staffId: UUID!
   staff: Staff! @ref(fields: "staffId", references: "id")