v1.1 Bulk Operations + Cert Alerting

Delivered: Async bulk pass operations (create/update/delete) with pg-boss queue and per-item partial failure isolation, plus Apple p12 certificate expiration alerting with threshold-based SMTP notifications.

Key accomplishments:
- POST/PATCH/DELETE /v1/passes/bulk: 202 Accepted with jobId; pg-boss fans out with p-limit(5), per-item error isolation
- GET /v1/jobs/:jobId: tenant-isolated status polling with per-item results; RLS-enforced 404 on cross-tenant access
- checkCertificates(): cross-tenant Apple p12 scanner, THRESHOLDS [60,30,7], dedup via credential metadata, SMTP + log.warn fallback
- GET /v1/credentials/status: single authenticated call for all tenant Apple credential expiry status
- 266/266 tests green at ship

See .planning/MILESTONES.md for full details.