fix(backend/maintenance): also run cert-expiry watcher in manual trigger path

77fde56f hooked CheckEmbeddedCertExpiryAsync only into RunAllAsync (the 2h
timer). Manual triggers via POST /api/maintenance/trigger call RunManualAsync,
which is a different code path - so manual runs were silently skipping the
watcher and gave a false sense of "no alert means bucket is healthy". Mirror
the timer-path call inside the !aggregateOnly block so manual ops verification
exercises the watcher just like the scheduled run does.

Aggregate-only manual runs (date catch-up) still skip it, since they're for
backfilling historical metrics and don't need cert checks.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/Backend/AutopilotMonitor.Functions/Services/MaintenanceService.cs

@@ -167,6 +167,9 @@ namespace AutopilotMonitor.Functions.Services
                     // StoreSessionAsync Replace-mode IndexRowKey bug (now fixed).
                     await _maintenanceRepo.CleanupGhostSessionIndexEntriesAsync();
 
+                    // Mirror the timer path: check embedded Intune cert bundle for
+                    // expiring members so manual triggers also exercise the watcher.
+                    await CheckEmbeddedCertExpiryAsync();
                 }
 
                 await RecomputePlatformStatsAsync();