feat: complete release readiness work

- consolidate API ownership and remove dead vendor code

- add Stripe billing, learning paths, and public CV hardening

- add migration, recovery, security, audit, and browser gates

docs/architecture/cv-theme-engine.md

@@ -7,7 +7,7 @@
 
 **A theme is data, not code.** There is exactly one renderer — `ThemedCvRenderer`
 (`JobTrackerApi/Services/ThemedCvRenderer.cs`) — with a single render path. Every visual difference
-between themes is expressed by the fields of a `CvTheme` record (`Models/CvTheme.cs`). Adding a theme
+between themes is expressed by the fields of a `CvTheme` record (`JobTrackerApi/Models/CvTheme.cs`). Adding a theme
 never touches the renderer.
 
 This replaces the previous approach (`CvTemplateRenderer`, one hand-written HTML method per template),
@@ -30,7 +30,7 @@ section keys move to the sidebar for the two-column layouts.
 
 ## Adding a theme
 
-1. Append one `CvTheme { … }` to `CvThemeCatalog.Themes` (`Models/CvTheme.cs`). Only override the
+1. Append one `CvTheme { … }` to `CvThemeCatalog.Themes` (`JobTrackerApi/Models/CvTheme.cs`). Only override the
    fields that differ from the defaults.
 2. Nothing else. It appears in `GET /api/cv/themes`, the Customize tab picker, and renders.