feat: Phase 0 foundation — Job entity, expanded pipeline, AI service lockdown, DateApplied history

Unblocks the documented core workflow and closes the AI-service exposure,
without changing existing behaviour.

Job/JobApplication split (additive; see ADR-002):
- New Job entity (the opportunity) with owner-scoped query filter; nullable
  JobApplication.JobId FK. Nothing reads Job yet.
- Migration AddJobEntityAndProspectStages, hand-edited to drop reconciler-owned
  tables the scaffolder re-emitted; verified against the real dev DB.

Pipeline: 10 internal stages across three concerns kept separate —
PipelineStage (workflow) / PipelineGroup (UI: NotApplied/Active/Closed) /
PipelineCategory (analytics). Adds Saved/Interested/Preparing/Withdrawn;
keeps Waiting and Ghosted. Kanban shows 3 grouped columns; cards keep a stage
chip and full transitions; drag applies only safe transitions (never infers
Ghosted/Withdrawn).

DateApplied nullable + SavedAt. Cleared when leaving Applied so analytics stay
accurate; the discarded date is preserved as an AppliedDateCleared JobEvent.

AI service lockdown: no host port; private ai_internal network (backend is the
only other member); X-Ai-Service-Token required on all non-/health endpoints;
AI_SERVICE_TOKEN mandatory via compose. Verified backend-only against the live
stack.

Also carries two pre-existing working-tree files (views/ProfilePage.tsx,
views/CareerWorkspacePage.tsx) so the tree is clean for the branch integration.

Tests: +40 backend (247 total), +5 sidecar (16), +15 frontend.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

JobTrackerApi/Program.cs

@@ -146,6 +146,7 @@ builder.Services.AddHttpClient("jobimport")
     });
 
 // Local AI service (FastAPI). Supports summarization and OCR/text extraction.
+// Every caller goes through this named client, so the shared-secret header is set once here.
 builder.Services.AddHttpClient("ai-service", client =>
 {
     var baseUrl = builder.Configuration["Ai:BaseUrl"]
@@ -153,6 +154,12 @@ builder.Services.AddHttpClient("ai-service", client =>
         ?? "http://127.0.0.1:8001";
     client.BaseAddress = new Uri(baseUrl);
     client.Timeout = TimeSpan.FromSeconds(30);
+
+    var serviceToken = builder.Configuration["Ai:ServiceToken"];
+    if (!string.IsNullOrWhiteSpace(serviceToken))
+    {
+        client.DefaultRequestHeaders.Add("X-Ai-Service-Token", serviceToken);
+    }
 });
 
 builder.Services.AddMemoryCache();