Server-authoritative pause semantics for timed workflows

Pausing a timed workflow must be a server-authoritative transition, not a UI-only countdown change. Store the frozen remaining duration, exclude paused records from expiry workers, block every mutation path, and resume from database time plus the frozen duration.

Add-time, pause, and resume operations should be transactional, idempotent, and emit audit events only for actual transitions. Stable idempotency keys are part of the audit model: repeated no-op requests must not append duplicate events.

This applies to leased or timed workflows. It does not update deadlines cached by already-running external workers; those require a deadline-update contract or a safe checkpoint and reconnect path.