Auth Web MBR: handle expired NRs/application

**THIS TICKET NEEDS DESIGN AND REQUIREMENTS**

### NR expires before application is created

Same as now:

### NR expires after application is created

Same as now:

Filing could be in the following states:
- draft
- awaiting review (*)
- change requested (*)
- resubmitted (*)
- future effective pending (not handled currently?)

(*) _Need to do something with review record. Ask staff to reject it? New status (expired)?_

### Application expires

_Need a batch job to expire the application._

- same as when NR expires?
- only applies to numbered applications?
- start date = date that change was requested

The issue names no files, tests, or entry points. Start by confirming requirements for NR and application expiry across draft, review, resubmitted, and future-effective states, including review-record handling and batch-job timing. Done is an agreed design and requirements set before implementation.

Written by the indexing model from the issue text.