feat: scope runtime workflows by candidate

[pashawkola33]

Summary

• add a shared runtime candidate context resolved from the configured candidate key
• scope candidate-specific job analysis to the configured candidate's active profile
• make document generation validate the exact persisted candidate/profile identity from JobAnalysis
• remove legacy installation-wide candidate profile lookups
• add coverage for multiple active candidates sharing the same profile version
• document the runtime compatibility boundary and defer authenticated per-request candidate selection

Validation

• focused affected unit/integration/PostgreSQL/concurrency/end-to-end tests passed sequentially
• ./mvnw verify — BUILD SUCCESS
• Failsafe: 104 tests, 0 failures, 0 errors, 0 skipped
• git diff --check — clean
• V14/V15 unchanged

Scope

No authentication/API contract redesign, no migrations, no ingestion/scoring/Telegram authorization changes, and no production/Azure changes.