feat: complete release readiness work

- consolidate API ownership and remove dead vendor code

- add Stripe billing, learning paths, and public CV hardening

- add migration, recovery, security, audit, and browser gates

JobTrackerApi/Models/TwoFactorRecoveryCode.cs

@@ -0,0 +1,12 @@
+namespace JobTrackerApi.Models;
+
+// One-time-use 2FA recovery codes. Plaintext is shown once at generation time and never
+// persisted -- only the SHA-256 hash is stored so a DB read can't recover usable codes.
+public sealed class TwoFactorRecoveryCode
+{
+    public int Id { get; set; }
+    public string UserId { get; set; } = "";
+    public string CodeHash { get; set; } = "";
+    public DateTimeOffset CreatedAtUtc { get; set; }
+    public DateTimeOffset? UsedAtUtc { get; set; }
+}