[studio] fix: refresh K8s certificate expiry status

[ai-yang]

Summary

• derive certificate status and daysRemaining from the current time when certificates are listed or updated
• keep repository values detached by refreshing copied response objects
• use one injectable Clock for create, update, renew, and read-time expiry calculations
• preserve the existing 30-day expiring threshold and mutable list behavior

Root cause

K8sCertService calculated time-derived fields only when a certificate was created or renewed. A long-running Studio instance therefore kept returning the persisted historical status even after the certificate crossed the expiring or expired boundary.

The service now refreshes these derived fields at the read/update boundary without mutating stored objects returned by the repository.

Validation

• unmodified Java 21 baseline: deterministic regression failed in 5/5 isolated Maven processes
• fixed list/update expiry regressions: 20 isolated Java 21 Maven processes, 2/2 each (40/40)
• K8sCertServiceTest: 15/15
• K8sCertControllerTest: 9/9
• complete server suite: 488/488
• Maven package: 488/488
• Maven validate and Checkstyle: passed
• git diff --check: passed

Fixes #759