Invariant: certificate expiry alerts (31 October 2026)

Certificate holders get in-app alerts 30 days and 7 days before expiry, and for 30 days after it.
An optional quality-calendar layer shows certificate expiry dates.

New capabilities are switched on per organization. Read the release notes.