Add KYC expiration automation to kyc.worker

[FroDev-CR]

Closes #91

Summary

Adds background automation to expire KYC submissions once their expiresAt window has passed, and notifies affected beneficiaries — closing the gap where approved KYC could remain VALID indefinitely.

Changes

• kyc.worker.ts: new periodic EXPIRE_KYC_SUBMISSIONS job (configurable cron, hourly by default) that scans APPROVED KYCSubmission rows with expiresAt <= now and transitions them to EXPIRED.
• Idempotent & safe to run repeatedly/concurrently: only APPROVED rows are ever matched, and each transition re-checks status inside the write transaction to close the race window.
• Resets the linked beneficiary to PENDING, writes a KYC_EXPIRED audit log entry, and dispatches a KYC_STATUS_CHANGED webhook.
• Notifies the beneficiary by email + in-app (respecting notification preferences) with resubmission instructions, and optionally alerts active admins/reviewers for high-risk (fraud score) expirations.
• New kycExpiration config block (cron interval, batch size, admin-alert threshold, feature flag) — all via env vars.
• Adds KYC_EXPIRED to NotificationType/AuditAction enums + migration, new kyc-expiration email template, and wires the worker into app startup (it wasn't being started before).
• Unit tests covering expiration detection, status transition, idempotency, and notification dispatch.
• Documented in docs/ARCHITECTURE.md.

Testing

Reviewed manually against existing patterns (moderation/analytics workers); added unit tests for BeneficiaryService.expireKYCSubmissions, kyc.worker.ts job orchestration, and notification service methods.