feat: Phase 0 foundation — Job entity, expanded pipeline, AI service lockdown, DateApplied history

Unblocks the documented core workflow and closes the AI-service exposure,
without changing existing behaviour.

Job/JobApplication split (additive; see ADR-002):
- New Job entity (the opportunity) with owner-scoped query filter; nullable
  JobApplication.JobId FK. Nothing reads Job yet.
- Migration AddJobEntityAndProspectStages, hand-edited to drop reconciler-owned
  tables the scaffolder re-emitted; verified against the real dev DB.

Pipeline: 10 internal stages across three concerns kept separate —
PipelineStage (workflow) / PipelineGroup (UI: NotApplied/Active/Closed) /
PipelineCategory (analytics). Adds Saved/Interested/Preparing/Withdrawn;
keeps Waiting and Ghosted. Kanban shows 3 grouped columns; cards keep a stage
chip and full transitions; drag applies only safe transitions (never infers
Ghosted/Withdrawn).

DateApplied nullable + SavedAt. Cleared when leaving Applied so analytics stay
accurate; the discarded date is preserved as an AppliedDateCleared JobEvent.

AI service lockdown: no host port; private ai_internal network (backend is the
only other member); X-Ai-Service-Token required on all non-/health endpoints;
AI_SERVICE_TOKEN mandatory via compose. Verified backend-only against the live
stack.

Also carries two pre-existing working-tree files (views/ProfilePage.tsx,
views/CareerWorkspacePage.tsx) so the tree is clean for the branch integration.

Tests: +40 backend (247 total), +5 sidecar (16), +15 frontend.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

job-tracker-ui/src/views/CareerWorkspacePage.tsx

@@ -1,10 +1,13 @@
-import React from "react";
+import React, { useState } from "react";
 
-import { Alert, Box, Paper, Typography } from "@mui/material";
+import { Alert, Box, Paper, Tab, Tabs, Typography } from "@mui/material";
 
 import ProfilePage from "./ProfilePage";
 
 export default function CareerWorkspacePage() {
+  const [tab, setTab] = useState<"master" | "builder">("master");
+  const [hasMasterCv, setHasMasterCv] = useState(false);
+
   return (
     <Box sx={{ display: "grid", gap: 2 }}>
       <Paper sx={{ p: 2.5, borderRadius: 4, boxShadow: "0px 8px 24px -12px rgba(15,23,42,0.12)" }}>
@@ -16,7 +19,18 @@ export default function CareerWorkspacePage() {
       <Alert severity="info" sx={{ borderRadius: 3 }}>
         Your master profile is the source of truth. Job-specific CV drafts remain separate and never overwrite it.
       </Alert>
-      <ProfilePage careerOnly />
+      <Paper sx={{ borderRadius: 4, overflow: "hidden", boxShadow: "0px 8px 24px -12px rgba(15,23,42,0.12)" }}>
+        <Tabs value={tab} onChange={(_, value) => setTab(value)} variant="scrollable" allowScrollButtonsMobile sx={{ px: 1.5, pt: 1 }}>
+          <Tab value="master" label="Master CV" />
+          <Tab value="builder" label="CV Builder" disabled={!hasMasterCv} />
+        </Tabs>
+        {!hasMasterCv ? <Alert severity="info" sx={{ mx: 2.5, mb: 0, borderRadius: 3 }}>
+          Create your Master CV first. Upload an existing CV or add your career history manually; the builder will unlock when the profile has content.
+        </Alert> : null}
+        <Box sx={{ p: { xs: 1.5, md: 2.5 } }}>
+          <ProfilePage careerOnly careerView={tab} onMasterCvAvailabilityChange={setHasMasterCv} />
+        </Box>
+      </Paper>
     </Box>
   );
 }

job-tracker-ui/src/views/ProfilePage.tsx

@@ -226,7 +226,15 @@ function FieldReviewNote({ metadata }: { metadata?: StructuredCvFieldMetadata })
   );
 }
 
-export default function ProfilePage({ careerOnly = false }: { careerOnly?: boolean }) {
+export default function ProfilePage({
+  careerOnly = false,
+  careerView = "master",
+  onMasterCvAvailabilityChange,
+}: {
+  careerOnly?: boolean;
+  careerView?: "master" | "builder";
+  onMasterCvAvailabilityChange?: (hasMasterCv: boolean) => void;
+}) {
   const { toast } = useToast();
   const { t } = useI18n();
   const cvInputRef = useRef<HTMLInputElement | null>(null);