feat: complete release readiness work

- consolidate API ownership and remove dead vendor code

- add Stripe billing, learning paths, and public CV hardening

- add migration, recovery, security, audit, and browser gates

JobTrackerApi.Tests/ApplicationChecklistTests.cs

@@ -228,6 +228,25 @@ public sealed class ApplicationChecklistTests
         Assert.Equal(custom!.Id, next!.Id);
     }
 
+    [Fact]
+    public async Task Learning_recommendations_preserve_user_decisions_and_reopen_only_auto_completed_items()
+    {
+        var (db, svc) = New("user-1");
+        await using var _ = db;
+        var job = await SeedAsync(db, "user-1");
+
+        var first = await svc.SyncLearningRecommendationsAsync("user-1", job.Id, ["Kubernetes", "AWS"], default);
+        var kubernetes = first.Single(item => item.Keyword == "Kubernetes");
+        await svc.UpdateAsync("user-1", job.Id, kubernetes.Id,
+            new ChecklistItemInput(null, null, null, ChecklistStatuses.Done, null), default);
+
+        await svc.SyncLearningRecommendationsAsync("user-1", job.Id, [], default);
+        var reopened = await svc.SyncLearningRecommendationsAsync("user-1", job.Id, ["Kubernetes", "AWS"], default);
+
+        Assert.Equal(ChecklistStatuses.Done, reopened.Single(item => item.Keyword == "Kubernetes").Status);
+        Assert.Equal(ChecklistStatuses.Pending, reopened.Single(item => item.Keyword == "AWS").Status);
+    }
+
     [Fact]
     public async Task Interview_prep_is_only_outstanding_at_the_interview_stage()
     {
@@ -252,6 +271,7 @@ public sealed class ApplicationChecklistTests
         Assert.Null(await svc.GetAsync("user-1", other.Id, default));
         Assert.Null(await svc.AddAsync("user-1", other.Id, new ChecklistItemInput("Sneak", null, null, null, null), default));
         Assert.False(await svc.DeleteAsync("user-1", other.Id, 1, default));
+        Assert.Empty(await svc.SyncLearningRecommendationsAsync("user-1", other.Id, ["Kubernetes"], default));
     }
 
     [Fact]