feat: complete release readiness work

- consolidate API ownership and remove dead vendor code

- add Stripe billing, learning paths, and public CV hardening

- add migration, recovery, security, audit, and browser gates

docs/architecture/career-profile-model.md

@@ -10,7 +10,7 @@
 > ## Implementation status (2026-07-18) — SHIPPED
 >
 > The model below is implemented on `main` and verified against the live database:
-> - **Entities** (`Models/CareerEntities.cs`): `CareerExperience`, `CareerEducation`, `CareerSkill`,
+> - **Entities** (`JobTrackerApi/Models/CareerEntities.cs`): `CareerExperience`, `CareerEducation`, `CareerSkill`,
 >   `CareerProject`, `CareerCertification`, `CareerLanguage` — relational children of `CareerProfile`;
 >   long tail in `CareerProfile.LongTailJson`. Migration `AddCareerProfileRelationalChildren`
 >   (applied cleanly on the real dev DB and the running container).
@@ -40,7 +40,7 @@ The Career Workspace foundation (`992f89e`) stores the whole profile as **one JS
   `CareerProfileService.SaveVersionAsync` (dual-write). One row per user.
 - `CareerProfileVersion` — append-only history: one row per save, with a `Source` discriminator.
 
-The blob shape (`Models/StructuredCvProfile.cs`) already has structured items for **Jobs, Education,
+The blob shape (`JobTrackerApi/Models/StructuredCvProfile.cs`) already has structured items for **Jobs, Education,
 Certifications, Projects, Languages**, plus `Skills`/`Summary`/`Interests` (string lists) and
 `OtherSections` (title + items). `CareerProfileService` already assigns **stable item IDs** to
 Jobs/Education/Certifications/Projects and normalizes free-text dates to `YYYY-MM`.