feat(healthcare): prove revalidation is real via official CMS data + self-verify

Skepticism ("is this even real?") is the top objection. The data IS accurate
(verified our subscribers' NPIs match the official CMS Revalidation Due Date List
exactly), so this is a credibility-presentation fix:

1. Email: replace the plain detail row with an "Official record - CMS Medicare
   Revalidation Due Date List" card (NPI, legal name, due date, days overdue)
   plus a "Verify on CMS.gov" button. Clearly labeled as our presentation of
   public CMS data, not a CMS screenshot (no impersonation).
2. API: npi/lookup now pulls the revalidation due date LIVE from the public CMS
   dataset (data.cms.gov) instead of the empty local table, and returns a
   revalidation{ due_date, source, cms_legal_name, verify_url } proof object.
3. Tool: /tools/npi-compliance-check shows a live "official record" card with a
   self-verify link when CMS returns a due date.

Builder now stores reval_due_date/days_overdue as separate attribs for the card
(existing 194 subscribers backfilled from their detail string).

scripts/build_healthcare_campaigns_cron.py

@@ -205,6 +205,11 @@ def main():
             "practice": r.get("name", ""),
             "specialty": r.get("specialty", ""),
             "state": r.get("state", ""),
+            # Separate fields so the email's "official CMS record" card can render
+            # the due date and overdue count cleanly (these mirror the authoritative
+            # CMS Revalidation Due Date List, verified to match by NPI).
+            "reval_due_date": r.get("reval_due_date", ""),
+            "days_overdue": str(r.get("days_overdue", "")),
             "detail": (f"{r.get('reval_due_date','')} ({r.get('days_overdue','')} days overdue)"
                        if r.get("reval_status") == "overdue" else r.get("reval_due_date", "")),
         }