feat: Phase 0 foundation — Job entity, expanded pipeline, AI service lockdown, DateApplied history

Unblocks the documented core workflow and closes the AI-service exposure,
without changing existing behaviour.

Job/JobApplication split (additive; see ADR-002):
- New Job entity (the opportunity) with owner-scoped query filter; nullable
  JobApplication.JobId FK. Nothing reads Job yet.
- Migration AddJobEntityAndProspectStages, hand-edited to drop reconciler-owned
  tables the scaffolder re-emitted; verified against the real dev DB.

Pipeline: 10 internal stages across three concerns kept separate —
PipelineStage (workflow) / PipelineGroup (UI: NotApplied/Active/Closed) /
PipelineCategory (analytics). Adds Saved/Interested/Preparing/Withdrawn;
keeps Waiting and Ghosted. Kanban shows 3 grouped columns; cards keep a stage
chip and full transitions; drag applies only safe transitions (never infers
Ghosted/Withdrawn).

DateApplied nullable + SavedAt. Cleared when leaving Applied so analytics stay
accurate; the discarded date is preserved as an AppliedDateCleared JobEvent.

AI service lockdown: no host port; private ai_internal network (backend is the
only other member); X-Ai-Service-Token required on all non-/health endpoints;
AI_SERVICE_TOKEN mandatory via compose. Verified backend-only against the live
stack.

Also carries two pre-existing working-tree files (views/ProfilePage.tsx,
views/CareerWorkspacePage.tsx) so the tree is clean for the branch integration.

Tests: +40 backend (247 total), +5 sidecar (16), +15 frontend.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Models/JobApplication.cs

@@ -9,8 +9,26 @@ public class JobApplication
     public string JobTitle { get; set; } = "";
     public int CompanyId { get; set; }
     public Company Company { get; set; } = null!;
+
+    // The opportunity this application is for. Nullable and unused for now: Phase 0 added the
+    // Job entity additively and JobApplication still owns the opportunity columns below.
+    // See Models/Job.cs and docs/decisions/ADR-002-job-application-model.md.
+    public int? JobId { get; set; }
+    public Job? Job { get; set; }
+
     public string Status { get; set; } = "Applied";
-    public DateTime DateApplied { get; set; } = DateTime.UtcNow;
+
+    /// <summary>
+    /// When the user submitted the application. Null while the job is still in a pre-application
+    /// (Prospect) stage — Saved/Interested/Preparing — because nothing has been submitted yet.
+    /// Callers must not synthesise a date for unapplied jobs: a fake DateApplied feeds the
+    /// follow-up/ghosting rules and the applied-volume analytics.
+    /// </summary>
+    public DateTime? DateApplied { get; set; }
+
+    /// <summary>When the user first captured this job. Always set.</summary>
+    public DateTime SavedAt { get; set; } = DateTime.UtcNow;
+
     public string? Location { get; set; }
     public string? Salary { get; set; }
 
@@ -59,6 +77,13 @@ public class JobApplication
     public List<Attachment> Attachments { get; set; } = new();
     public List<JobEvent> Events { get; set; } = new();
 
-    public int DaysSince => ((ResponseReceived ? (ResponseDate ?? DateTime.UtcNow) : DateTime.UtcNow) - DateApplied.ToUniversalTime()).Days;
+    /// <summary>
+    /// Days since the application was submitted. Null for pre-application (Prospect) stages:
+    /// with no DateApplied there is no elapsed time to report, and 0 would read as
+    /// "applied today".
+    /// </summary>
+    public int? DaysSince => DateApplied is null
+        ? null
+        : ((ResponseReceived ? (ResponseDate ?? DateTime.UtcNow) : DateTime.UtcNow) - DateApplied.Value.ToUniversalTime()).Days;
 }
 }