feat(jobs): complete workspace draft parity

JobTrackerApi.Tests/JobApplicationsApplicationPackageTests.cs

@@ -46,6 +46,77 @@ public sealed class JobApplicationsApplicationPackageTests
         Assert.Equal("Updated notes block", saved.Notes);
     }
 
+    [Fact]
+    public async Task Save_application_drafts_updates_and_clears_answer_without_changing_human_notes()
+    {
+        await using var db = CreateDb();
+        var company = new Company { Name = "Acme", OwnerUserId = "user-1" };
+        db.Companies.Add(company);
+        await db.SaveChangesAsync();
+
+        var job = new JobApplication
+        {
+            JobTitle = "Backend Developer",
+            CompanyId = company.Id,
+            OwnerUserId = "user-1",
+            Notes = "Human note\n\n<<<APPLICATION_ANSWER_DRAFT>>>\nOld answer\n<<<END_APPLICATION_ANSWER_DRAFT>>>",
+            RecruiterMessageDraft = "Old recruiter message"
+        };
+        db.JobApplications.Add(job);
+        await db.SaveChangesAsync();
+
+        var controller = CreateController(db, Mock.Of<ISummarizerService>(), "user-1");
+        var updated = await controller.SaveApplicationDrafts(
+            job.Id,
+            new SaveApplicationDraftsRequest(null, null, " New recruiter message ", " New answer "),
+            CancellationToken.None);
+
+        Assert.IsType<NoContentResult>(updated);
+        Assert.Equal("Human note", JobApplicationHelpers.RemoveSavedApplicationAnswerDraft(job.Notes));
+        Assert.Equal("New answer", JobApplicationHelpers.ExtractSavedApplicationAnswerDraft(job.Notes));
+        Assert.Equal("New recruiter message", job.RecruiterMessageDraft);
+
+        job.Notes += "\n\n<<<APPLICATION_ANSWER_DRAFT>>>\nDuplicate stale answer\n<<<END_APPLICATION_ANSWER_DRAFT>>>";
+        var cleared = await controller.SaveApplicationDrafts(
+            job.Id,
+            new SaveApplicationDraftsRequest(null, null, "", ""),
+            CancellationToken.None);
+
+        Assert.IsType<NoContentResult>(cleared);
+        Assert.Equal("Human note", job.Notes);
+        Assert.Null(job.RecruiterMessageDraft);
+    }
+
+    [Fact]
+    public async Task Save_application_drafts_cannot_mutate_another_users_application()
+    {
+        await using var db = CreateDb();
+        var company = new Company { Name = "Other Acme", OwnerUserId = "user-2" };
+        db.Companies.Add(company);
+        await db.SaveChangesAsync();
+
+        var otherUsersJob = new JobApplication
+        {
+            JobTitle = "Private role",
+            CompanyId = company.Id,
+            OwnerUserId = "user-2",
+            Notes = "Private note",
+            RecruiterMessageDraft = "Private draft"
+        };
+        db.JobApplications.Add(otherUsersJob);
+        await db.SaveChangesAsync();
+
+        var controller = CreateController(db, Mock.Of<ISummarizerService>(), "user-1");
+        var result = await controller.SaveApplicationDrafts(
+            otherUsersJob.Id,
+            new SaveApplicationDraftsRequest(null, null, "Changed", "Changed"),
+            CancellationToken.None);
+
+        Assert.IsType<NotFoundResult>(result);
+        Assert.Equal("Private note", otherUsersJob.Notes);
+        Assert.Equal("Private draft", otherUsersJob.RecruiterMessageDraft);
+    }
+
     [Fact]
     public async Task Generate_application_package_uses_imported_correspondence_and_recruiter_context()
     {