clia: new CLIA certificate renewal service, order page, email template + harvest

Set up the CLIA recurring-renewal vein (every clinical lab renews its CLIA cert
on a 2-year cycle; CMS publishes the full lab file with expiration dates):
- service-catalog: clia-renewal ($449, discountable) + order page (npi-intake
  steps) + intake manifest entry.
- harvest_clia_renewals.py: parse the CMS Provider-of-Services CLIA file, filter
  to labs expiring within a window (default 120d), emit name/address/phone/expiry.
  676k labs -> ~70k expiring in the next ~4 months.
- match_clia_to_nppes.py: CLIA has no NPI/email, so bridge to emailable NPPES
  orgs by normalized name+zip to recover NPI+email (yield TBD; labs that do not
  match still have clean phone+postal for a phone/mail channel).
- hc_clia_renewal.html: warm turnover-safety-net email with the striped official-
  record card (CLIA #, expiry, status), verify-on-CMS-QCOR, founder guarantee
  card, full CAN-SPAM address.

api/src/service-catalog.ts

@@ -522,6 +522,12 @@ export const COMPLIANCE_SERVICES: Record<string, ComplianceService> = {
     erpnext_item: "NPPES-UPDATE",
     discountable: true,
   },
+  "clia-renewal": {
+    name: "CLIA Certificate Renewal",
+    price_cents: 44900,
+    erpnext_item: "CLIA-RENEWAL",
+    discountable: true,
+  },
   "medicare-enrollment": {
     name: "Medicare Enrollment (PECOS)",
     price_cents: 69900,