fix(cv): support application variant deep links

The Application Workspace CV section linked to /cv-builder?variant={id}. That
route does not exist: the builder is mounted at /career/builder/:id and reads the
variant from the path, not a query string. The button dead-ended.

Corrected the href. No loading logic was added — the editor already loads the
variant by id and already has a safe error state, and ownership is already
enforced server-side, where CvVariantService scopes every read to the owner and
the controller returns 404.

Added tests for the deep-link entry point, which had none: the variant loads from
the route, a missing variant shows the error state rather than an empty editor,
and another user's variant is refused identically. The asset test now asserts the
exact href, so a route that the router does not serve fails the build instead of
shipping.

118 frontend tests and the production build pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

job-tracker-ui/src/components/ApplicationAssets.tsx

@@ -148,7 +148,9 @@ export function ApplicationCvSection({ jobId }: { jobId: number }) {
                     size="small"
                     variant="outlined"
                     endIcon={<OpenInNewIcon fontSize="small" />}
-                    href={`/cv-builder?variant=${data.attachedVariantId}`}
+                    // The builder's real route. It loads the variant from :id and enforces ownership
+                    // server-side, so there is no second CV loading path here.
+                    href={`/career/builder/${data.attachedVariantId}`}
                   >
                     Edit, preview and export
                   </Button>