feat: complete release readiness work

- consolidate API ownership and remove dead vendor code

- add Stripe billing, learning paths, and public CV hardening

- add migration, recovery, security, audit, and browser gates

job-tracker-ui/src/views/PublicCvPage.tsx

@@ -7,6 +7,7 @@ import { api } from "../api";
 // iframe. noindex is enforced server-side (X-Robots-Tag) and reinforced with a meta tag here.
 export default function PublicCvPage() {
   const { slug } = useParams();
+  const pdfUrl = `${api.defaults.baseURL}/public-cv/${slug}/pdf`;
   const [html, setHtml] = useState<string | null>(null);
   const [error, setError] = useState<string | null>(null);
 
@@ -49,7 +50,10 @@ export default function PublicCvPage() {
   }
 
   return (
-    <div style={{ minHeight: "100vh", background: "#e9edf2", padding: "24px 0", display: "flex", justifyContent: "center" }}>
+    <div style={{ minHeight: "100vh", background: "#e9edf2", padding: "24px 0", display: "flex", flexDirection: "column", alignItems: "center", gap: 16 }}>
+      <a href={pdfUrl} download style={{ padding: "10px 16px", borderRadius: 8, background: "#1d4ed8", color: "#fff", font: "600 14px system-ui", textDecoration: "none" }}>
+        Download PDF
+      </a>
       <iframe
         title="Public CV"
         srcDoc={html}