fix: record last_eligibility_run_at only when eligibility rules run

[mdiapenabc]

Description

PR #437 introduced last_eligibility_run_at to fix Hold/Resume (staging was compared against resume effective date). The field was only updated on upsert, but he UI treat it as “last time eligibility ran on this contact.”

After a single-contact run where rules evaluate but skip upsert (same status, unchanged staging), Last Eligibility Run stayed stale even though eligibility ran.

This PR aligns behaviour: last_eligibility_run_at = last time decision rules ran, not last upsert, and not protected field refresh (rules never run there).

Hold/Resume and user-set are unchanged: Hold/Resume still do not touch this field; user-set still skips rules when staging is unchanged since last rules run.

What changed

• Record last_eligibility_run_at when rules run and skips upsert (narrow UPDATE, no ICM sync side effects)
• Record it after rule-based upserts via recordEligibilityRunAt(); stop setting it on upsert ON CONFLICT UPDATE
• Protected field refresh (on_hold, etc.) upserts with rulesRan: false — fields refresh, watermark does not move
• New contacts still get last_eligibility_run_at on INSERT (first rules run)
• DTO description updated to “last ran decision rules”
• Unit tests updated for new execute paths (64 passing)

How to test

• Run eligibility on a contact with unchanged staging: Last Eligibility Run updates, status unchanged
• Hold -> fetch -> resume -> run eligibility (user-set) -> staging fields apply; watermark was not advanced by Hold/Resume
• Run eligibility on On Hold contact with staging change -> fields refresh, status stays on_hold, Last Eligibility Run unchanged
• User-set contact, staging unchanged -> rules skip, status preserved, timestamp unchanged
• npm test -- src/sync/eligibility/eligibility.service.spec.ts