feat: complete release readiness work

- consolidate API ownership and remove dead vendor code

- add Stripe billing, learning paths, and public CV hardening

- add migration, recovery, security, audit, and browser gates

job-tracker-ui/src/match-score-panel.test.tsx

@@ -35,6 +35,10 @@ const matchScore = {
     { section: 'Experience', matched: 3, total: 6 },
   ],
   hasEnoughSignal: true,
+  learningRecommendations: [
+    { id: 71, keyword: 'Kubernetes', status: 'pending' },
+    { id: 72, keyword: 'GraphQL', status: 'pending' },
+  ],
 };
 
 function renderDialog() {
@@ -84,13 +88,25 @@ test('match score panel shows the score, matched and missing keywords', async ()
   expect(await screen.findByText('Docker')).toBeInTheDocument();
 
   // Missing keyword chips
-  expect(await screen.findByText('Kubernetes')).toBeInTheDocument();
-  expect(await screen.findByText('GraphQL')).toBeInTheDocument();
+  expect((await screen.findAllByText('Kubernetes')).length).toBeGreaterThan(0);
+  expect((await screen.findAllByText('GraphQL')).length).toBeGreaterThan(0);
 
   // Section coverage
   expect(await screen.findByText('Skills: 4/6')).toBeInTheDocument();
 });
 
+test('learning recommendations can be completed or dismissed', async () => {
+  renderDialog();
+
+  fireEvent.click((await screen.findAllByRole('button', { name: /mark learned/i }))[0]);
+  expect(mockedApi.patch).toHaveBeenCalledWith('/jobapplications/42/checklist/71', { status: 'done' });
+  expect(await screen.findByText('Learned')).toBeInTheDocument();
+
+  fireEvent.click(screen.getAllByRole('button', { name: /dismiss/i })[0]);
+  expect(mockedApi.patch).toHaveBeenCalledWith('/jobapplications/42/checklist/72', { status: 'dismissed' });
+  expect(await screen.findByText('1 dismissed')).toBeInTheDocument();
+});
+
 test('match score panel degrades gracefully when there is not enough signal', async () => {
   mockedApi.get.mockImplementation((url: string) => {
     if (url === '/jobapplications/42') {