feat: Phase 0 foundation — Job entity, expanded pipeline, AI service lockdown, DateApplied history

Unblocks the documented core workflow and closes the AI-service exposure,
without changing existing behaviour.

Job/JobApplication split (additive; see ADR-002):
- New Job entity (the opportunity) with owner-scoped query filter; nullable
  JobApplication.JobId FK. Nothing reads Job yet.
- Migration AddJobEntityAndProspectStages, hand-edited to drop reconciler-owned
  tables the scaffolder re-emitted; verified against the real dev DB.

Pipeline: 10 internal stages across three concerns kept separate —
PipelineStage (workflow) / PipelineGroup (UI: NotApplied/Active/Closed) /
PipelineCategory (analytics). Adds Saved/Interested/Preparing/Withdrawn;
keeps Waiting and Ghosted. Kanban shows 3 grouped columns; cards keep a stage
chip and full transitions; drag applies only safe transitions (never infers
Ghosted/Withdrawn).

DateApplied nullable + SavedAt. Cleared when leaving Applied so analytics stay
accurate; the discarded date is preserved as an AppliedDateCleared JobEvent.

AI service lockdown: no host port; private ai_internal network (backend is the
only other member); X-Ai-Service-Token required on all non-/health endpoints;
AI_SERVICE_TOKEN mandatory via compose. Verified backend-only against the live
stack.

Also carries two pre-existing working-tree files (views/ProfilePage.tsx,
views/CareerWorkspacePage.tsx) so the tree is clean for the branch integration.

Tests: +40 backend (247 total), +5 sidecar (16), +15 frontend.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

job-tracker-ui/src/types.ts

@@ -86,7 +86,12 @@ export interface JobApplication {
   company: Company;
   companyId?: number;
   status: string;
-  dateApplied: string;
+  // Null while the job sits in a pre-application stage (Saved/Interested/Preparing): nothing has
+  // been submitted, so there is no applied date. Render "—", never a fabricated date.
+  dateApplied: string | null;
+  // When the user captured the job. Always set — use it wherever a job needs a date to sort or
+  // show regardless of whether it has been applied to.
+  savedAt: string;
   location?: string;
   salary?: string;
   salaryMin?: number | null;
@@ -118,7 +123,8 @@ export interface JobApplication {
   hasPortfolio?: boolean;
   hasOtherAttachment?: boolean;
 
-  daysSince: number;
+  // Null when dateApplied is null — there is no elapsed time to report before applying.
+  daysSince: number | null;
   isDeleted?: boolean;
   deletedAt?: string;
   needsFollowUp?: boolean;