feat(npi): offer paper CMS-855 path (e-sign + we mail to MAC) alongside I&A surrogacy

- order-confirmation email presents both filing methods: paper CMS-855 (no
  account needed, client e-signs one page, we print+mail to their MAC) and
  I&A surrogacy (faster, needs CMS account). NPPES-only services note that
  surrogacy is required (web-only).
- npi_provider handlers record the access model per service in admin todos.
- marketing copy leads with the lowest-friction paper option.

scripts/workers/services/npi_provider.py

@@ -40,6 +40,9 @@ _SLUG_META = {
             "the revalidation due date on the CMS revalidation list, update the "
             "enrollment record, and submit. Capture the PECOS tracking ID."
         ),
+        "access": (
+            "PECOS via CMS I&A surrogacy (preferred). Fallback: paper CMS-855I/B/R, provider wet-signs cert page, mail to provider's MAC."
+        ),
         "priority": "high",
     },
     "npi-reactivation": {
@@ -49,6 +52,9 @@ _SLUG_META = {
             "Reactivate the deactivated NPI in NPPES. Verify the deactivation "
             "reason, correct any stale data, and re-certify the record."
         ),
+        "access": (
+            "NPPES via CMS I&A surrogacy. No paper option (NPPES is web-only)."
+        ),
         "priority": "high",
     },
     "nppes-update": {
@@ -59,6 +65,9 @@ _SLUG_META = {
             "updates within 30 days of any change). Apply the requested field "
             "changes and certify."
         ),
+        "access": (
+            "NPPES via CMS I&A surrogacy. No paper option (NPPES is web-only)."
+        ),
         "priority": "normal",
     },
     "medicare-enrollment": {
@@ -68,6 +77,9 @@ _SLUG_META = {
             "Complete the provider's Medicare enrollment in PECOS (CMS-855). "
             "Confirm taxonomy, practice location, and authorized official."
         ),
+        "access": (
+            "PECOS via CMS I&A surrogacy (preferred). Fallback: paper CMS-855, provider wet-signs, mail to MAC."
+        ),
         "priority": "high",
     },
     "oig-sam-screening": {
@@ -78,6 +90,9 @@ _SLUG_META = {
             "SAM exclusion lists. Produce the screening certificate and flag any "
             "matches for escalation."
         ),
+        "access": (
+            "No client access needed - OIG LEIE + SAM.gov are public. Screen by NPI/name, issue certificate."
+        ),
         "priority": "normal",
     },
     "provider-compliance-bundle": {
@@ -88,6 +103,9 @@ _SLUG_META = {
             "revalidation watch, run OIG/SAM screening, and refresh the NPPES "
             "record. Set the next revalidation reminder."
         ),
+        "access": (
+            "PECOS/NPPES via CMS I&A surrogacy; screening is public. Paper CMS-855 fallback for the enrollment/revalidation piece."
+        ),
         "priority": "high",
     },
 }
@@ -123,7 +141,8 @@ class _BaseNPIHandler:
             f"PECOS Enrollment ID: {pecos_id or 'not provided'}\n"
             f"Specialty: {specialty or 'not provided'}\n"
             f"Practice state: {practice_state or 'not provided'}\n"
-            f"Portal: {meta['portal']}\n\n"
+            f"Portal: {meta['portal']}\n"
+            f"Access model: {meta['access']}\n\n"
             f"Review-staged: file manually, then mark this order complete."
         )