feat: complete release readiness work

- consolidate API ownership and remove dead vendor code

- add Stripe billing, learning paths, and public CV hardening

- add migration, recovery, security, audit, and browser gates

docs/architecture/cv-builder.md

@@ -25,8 +25,8 @@ The master profile is never written by the builder. A variant references career
 
 ## Variant model
 
-`CvVariant` (`Models/CvVariant.cs`) + `CvVariantVersion` (autosave history). The whole lens lives in one
-`SettingsJson` blob (`CvVariantSettings`, `Models/CvVariantSettings.cs`) because it is edited and saved
+`CvVariant` (`JobTrackerApi/Models/CvVariant.cs`) + `CvVariantVersion` (autosave history). The whole lens lives in one
+`SettingsJson` blob (`CvVariantSettings`, `JobTrackerApi/Models/CvVariantSettings.cs`) because it is edited and saved
 as a unit — never queried field-by-field. A variant stores:
 
 - `ThemeId` + overrides: accent, heading/body font, density, page size, photo/icons/page-numbers.
@@ -56,6 +56,11 @@ Anonymous (`/api/public-cv/{slug}`, `PublicCvController`): serves a public varia
 tenant filter — there is no current user). Unknown/private slug → 404
 (`CvBuilderTests.Private_variant_is_not_served_publicly`).
 
+Recruiters can download the same public render as PDF through `GET /api/public-cv/{slug}/pdf`.
+The endpoint applies the identical public/private slug check; unknown, revoked, or private links return
+404 without invoking the exporter. Anonymous PDF generation is limited to three requests per minute
+per public link because it launches Chromium. `PublicCvPage` exposes it as a native **Download PDF** link.
+
 ## Builder workflow (frontend)
 
 `/career/builder` lists variants (`CvBuilderPage`); the editor (`CvBuilderEditor`) is three tabs —