fix(security): enforce audited account, network and resource boundaries

Implement B01-B06 with regression coverage and retained validation evidence. Preserve the production ingress preflight; F04 runtime verification remains open.

job-tracker-ui/src/views/CvBuilderEditor.tsx

@@ -317,7 +317,8 @@ export default function CvBuilderEditor() {
       a.click();
       URL.revokeObjectURL(url);
     } catch (err) {
-      toast(getApiErrorMessage(err, t("cvEditorPdfFailed")), "error");
+      const status = (err as { response?: { status?: number } })?.response?.status;
+      toast(status === 503 ? t("cvPdfBusy") : status === 504 ? t("cvPdfTimedOut") : getApiErrorMessage(err, t("cvEditorPdfFailed")), "error");
     } finally {
       setExporting(false);
     }

job-tracker-ui/src/views/CvBuilderPage.tsx

@@ -116,7 +116,10 @@ export default function CvBuilderPage() {
       link.download = `${cvName || "cv"}.pdf`;
       link.click();
       URL.revokeObjectURL(url);
-    } catch (err) { toast(getApiErrorMessage(err, t("cvDashboardDownloadFailed")), "error"); }
+    } catch (err) {
+      const status = (err as { response?: { status?: number } })?.response?.status;
+      toast(status === 503 ? t("cvPdfBusy") : status === 504 ? t("cvPdfTimedOut") : getApiErrorMessage(err, t("cvDashboardDownloadFailed")), "error");
+    }
   };
 
   return (

job-tracker-ui/src/views/LoginPage.tsx

@@ -150,6 +150,8 @@ export default function LoginPage({ initialMode = "login" }: { initialMode?: "lo
           {cfg?.requireAuth ? t("authRequired") : t("authOptional")}
         </Typography>
 
+        {new URLSearchParams(location.search).has("sessionChanged") ? <Alert severity="info" sx={{ mb: 2 }}>{t("sessionChangedCleared")}</Alert> : null}
+
         {pendingToken ? (
           <TwoFactorChallenge
             pendingToken={pendingToken}