feat(cv): qualify templates and reliable local import processing

JobTrackerApi/Services/CvProcessingQueue.cs

@@ -23,19 +23,26 @@ public interface ICvProcessingQueue
 /// Compatibility name for the CV producer bridge. Durable scheduling and execution are owned by
 /// the shared AI operation queue; this type does not keep an in-memory CV queue.
 /// </summary>
-public sealed class CvProcessingQueue(AiOperationAdmission admission) : ICvProcessingQueue
+public sealed class CvProcessingQueue(AiOperationAdmission admission, JobTrackerContext db, IConfiguration configuration) : ICvProcessingQueue
 {
     public const string TaskType = "cv.process";
     public const string SubjectType = "cv_extraction_run";
 
     public async Task<AiOperationAdmissionResult?> EnqueueAsync(int runId, CancellationToken cancellationToken = default)
-        => await admission.EnqueueAsync(
+    {
+        var document = await db.CvExtractionRuns.AnyAsync(run => run.Id == runId &&
+            run.ParserVersion == ProfileCvController.DocumentParserVersion && run.Trigger == "document_import", cancellationToken);
+        if (document && !configuration.GetValue("Workers:AiOperationsEnabled", false) &&
+            !configuration.GetValue("Workers:CvDocumentImportsEnabled", false))
+            throw new AiOperationAdmissionException("cv_worker_disabled", "CV processing is disabled on this server. Ask the administrator to enable document processing, then retry the upload.", StatusCodes.Status503ServiceUnavailable);
+        return await admission.EnqueueAsync(
             TaskType,
             $"run:{runId}",
             SubjectType,
             runId.ToString(System.Globalization.CultureInfo.InvariantCulture),
             AiOperationPriorities.UserVisible,
             cancellationToken);
+    }
 }
 
 public sealed class NoOpCvProcessingQueue : ICvProcessingQueue