Persist verificationId for staff certificates

Add support for verificationId throughout the certificate flow: schema, GraphQL mutations/queries, domain, repositories, service implementation, and UI.

- Backend: add verificationId to Certificate schema and include it in upsert/create mutations; add auth insecureReason notes to related connector operations.
- Data layer: add verificationId parameter to StaffConnectorRepository API and propagation in implementation (SDK call remains commented with FIXME until dataconnect SDK is regenerated).
- Domain: add verificationId field to StaffCertificate (constructor, copyWith, props).
- Certificates flow: create verification via verificationService, pass returned verificationId to upsertStaffCertificate so the verification record is persisted with the certificate.
- UI: update certificate upload page to show existing file path, disable editing of name/issuer/number, rearrange fields, move remove button, change file icon and text style.
- Misc: minor lambda formatting cleanup in benefits mapping.

Note: the generated dataconnect SDK must be refreshed to enable the new .verificationId(...) call (there is a commented FIXME in the connector implementation).

backend/dataconnect/connector/application/queries.gql

@@ -451,7 +451,7 @@ query vaidateDayStaffApplication(
   $limit: Int
   $dayStart: Timestamp
   $dayEnd: Timestamp
-) @auth(level: USER) {
+) @auth(level: USER, insecureReason: "The staffId refers to the staff being validated. Ownership is verified at the application layer.") {
   applications(
     where: { 
       staffId: { eq: $staffId }