healthcare: verify CMS-10114 update path, correct NPI Enumerator address, build CMS-10114 filler

Verified firsthand against the live CMS-10114 (Rev. 02/25, OMB 0938-0931):
- Section 1A confirms paper is valid for Change of Information (#2) AND
  Reactivation (#4), not just initial enumeration. Resolves the UNCERTAIN flag.
- Current mailing address is CMS NPI Enumerator Services, Mail Stop DO-01-51,
  7500 Security Blvd, Baltimore MD 21244. The old Fargo PO Box 6059 is retired;
  corrected in mac_routing.NPI_ENUMERATOR + all docs.
- No electronic no-login equivalent exists for CMS (NPI Registry API is
  read-only; PECOS/NPPES-IA require login), unlike FMCSA's ask.fmcsa ticket form.
  So tiers stay: Standard=paper CMS-10114 (no login), Expedited=NPPES surrogate.

New: cms10114_pdf_filler.py fills the flat official form via text overlay
(reason checkbox + NPI + Section 2A identity + Section 4A cert name + signature
anchor); wired into npi_provider._generate_10114_for_signing for nppes-update.
Signed forms route to the NPI Enumerator via the existing daily batch.

Tests: test_cms10114.py 27/27, test_paper_batch.py 15/15, Astro build 58 pages.

docs/plans/Plan.md

@@ -5,7 +5,7 @@ the "paper" alternative is NEVER surfaced to the client):
 
 - **Standard service (default):** we handle the filing end-to-end. Client signs
   ONE certification and we submit + track to confirmation. (Internally this is the
-  paper path — 855 to the MAC, CMS-10114 to the NPI Enumerator in Fargo — but we
+  paper path — 855 to the MAC, CMS-10114 to the NPI Enumerator (Baltimore MD) — but we
   never say "paper" to the client; it's just "we file it for you.")
 - **Expedited (faster, framed positively at intake):** we ask if they can
   **electronically grant us CMS I&A Surrogate access**. We position this as
@@ -28,11 +28,11 @@ surrogate as *required* when a paper path exists; paper is always the default.
 - `api/src/routes/checkout.ts` (~L2155-2207) — already has the two-tier copy, BUT
   treats NPPES update/reactivation as **"online-only, surrogate required"** with
   NO standard fallback (`NPPES_ONLY_SLUGS`, `hasNppesOnly`). The directive says:
-  give those a Standard paper path too (CMS-10114 to Fargo) and make surrogate the
+  give those a Standard paper path too (CMS-10114 to NPI Enumerator (Baltimore MD)) and make surrogate the
   *expedited* option, not the only option.
 - `scripts/workers/services/npi_provider.py` — `access` strings call NPPES
   update/reactivation "NPPES via CMS I&A surrogate access (online-only)". Must
-  become "Standard: CMS-10114 paper to NPI Enumerator (Fargo), client signs;
+  become "Standard: CMS-10114 paper to NPI Enumerator (Baltimore MD), client signs;
   Expedited: NPPES via I&A surrogate." Also `_STANDARD_FILING_SLUGS` currently
   excludes `nppes-update` (it has no 855) — needs a CMS-10114 paper path instead.
 - `scripts/document_gen/templates/cms855_pdf_filler.py` — working 855 paper path
@@ -58,7 +58,7 @@ pricing changes.
 ## Approach (concrete ordered steps)
 1. **Confirm the CMS-10114 paper path** for NPPES data updates AND NPI
    reactivation (not just initial enumeration): paper CMS-10114 mailed to NPI
-   Enumerator (PO Box 6059, Fargo ND), client signature only, no I&A login.
+   Enumerator (Baltimore MD), client signature only, no I&A login.
    Cite the official source. This is what makes NPPES services "Standard, no
    login" instead of surrogate-required. (We currently have no CMS-10114 PDF.)
 2. **Lock the two-tier matrix for the 6 federal services.** For each slug record:
@@ -81,13 +81,13 @@ pricing changes.
    paper + e-sign, and the admin todo reflects Standard-default / Expedited-if-
    surrogate-granted. Mirror the existing 855 generate→upload→esign flow.
 5. **MAC + Fargo routing rule.** Document which Standard filings go where
-   (855 → provider's MAC by state/jurisdiction; CMS-10114 → Fargo). Confirm
+   (855 → provider's MAC by state/jurisdiction; CMS-10114 → NPI Enumerator (Baltimore MD)). Confirm
    `practice_state` intake field drives MAC envelope addressing.
 7. **Daily batched-mail fulfillment (Standard path).** Design the operational
    flow for paper filings that are signed + pending submission:
    - On each **postal working day morning** (skip weekends + federal/USPS
      holidays), gather ALL signed-and-pending paper filings, **group by
-     destination agency/address** (each MAC, the NPI Enumerator in Fargo, each
+     destination agency/address** (each MAC, the NPI Enumerator (Baltimore MD), each
      state Medicaid/CLIA agency).
    - For each destination, **merge all that day's documents into one print job**
      plus a **cover sheet** (Performance West sender, destination agency, date,
@@ -129,7 +129,7 @@ pricing changes.
   and Standard is the default on every surface.
 - **Standard path mechanism check:** `cms855_pdf_filler.fill_cms855("855i",...)`
   still yields filled PDF + cert anchor (read-only smoke render). If CMS-10114
-  filler is built, same smoke render proves a signable Fargo-bound PDF.
+  filler is built, same smoke render proves a signable Baltimore-bound PDF.
 - **Expedited path check:** confirm the surrogate-grant CTA + `ia_surrogacy`
   success action + admin todo together let a human file in PECOS/NPPES same-day;
   surrogate scope wording matches what CMS I&A actually grants (PECOS vs NPPES).
@@ -138,11 +138,11 @@ pricing changes.
   no "unknown" and no service that's portal-only-but-marketed-as-no-login.
 
 ## Open questions / decisions
-1. **NPPES update/reactivation Standard path:** is CMS-10114 paper-to-Fargo
-   accepted for *changes/reactivation* today (RESOLVE in step 1)? If yes, both
-   become Standard-default + surrogate-expedited. If CMS has gone online-only,
-   they stay surrogate-required and we say so honestly. (Directive assumes paper
-   works as Standard; step 1 verifies.)
+1. **NPPES update/reactivation Standard path:** ✅ RESOLVED — CMS-10114 paper IS
+   accepted for *changes AND reactivation* (verified against CMS-10114 Rev. 02/25,
+   Section 1A boxes #2 Change / #4 Reactivation). Mailing address is the NPI
+   Enumerator in **Baltimore MD** (the old Fargo PO Box 6059 is retired). Both
+   nppes-update and npi-reactivation are Standard-default + surrogate-expedited.
 2. **Build `cms10114_pdf_filler.py` this pass?** Needed for a real NPPES Standard
    path. Recommend: yes if step 1 confirms paper, mirroring the 855 filler;
    otherwise defer.