Persist verificationId for staff certificates

Add support for verificationId throughout the certificate flow: schema, GraphQL mutations/queries, domain, repositories, service implementation, and UI.

- Backend: add verificationId to Certificate schema and include it in upsert/create mutations; add auth insecureReason notes to related connector operations.
- Data layer: add verificationId parameter to StaffConnectorRepository API and propagation in implementation (SDK call remains commented with FIXME until dataconnect SDK is regenerated).
- Domain: add verificationId field to StaffCertificate (constructor, copyWith, props).
- Certificates flow: create verification via verificationService, pass returned verificationId to upsertStaffCertificate so the verification record is persisted with the certificate.
- UI: update certificate upload page to show existing file path, disable editing of name/issuer/number, rearrange fields, move remove button, change file icon and text style.
- Misc: minor lambda formatting cleanup in benefits mapping.

Note: the generated dataconnect SDK must be refreshed to enable the new .verificationId(...) call (there is a commented FIXME in the connector implementation).

backend/dataconnect/schema/certificate.gql

@@ -44,6 +44,7 @@ type Certificate @table(name: "certificates", key: ["staffId", "certificationTyp
   certificateNumber: String 
   
   validationStatus: ValidationStatus
+  verificationId: String
 
   staffId: UUID!
   staff: Staff! @ref(fields: "staffId", references: "id")