Store match-time ClientIpAddress on cvSearch.JobSearchTokens

Captures the IP when the user submits the CV match form and stores it on
the token, giving a full audit trail: token holds the match-site IP,
session holds the email link-click IP.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Apis/cv-matcher-api/Controllers/JobSearchController.cs

@@ -53,7 +53,7 @@ public sealed class JobSearchController : ControllerBase
             if (string.IsNullOrWhiteSpace(request.CvDocumentId) || string.IsNullOrWhiteSpace(request.Email))
                 return BadRequest(new ErrorResponse { Error = "CvDocumentId and Email are required.", Code = "invalid_request" });
 
-            var tokenId = await _tokenService.CreateTokenAsync(request.CvDocumentId, request.Email, request.Language, request.Keywords, request.Location, ct);
+            var tokenId = await _tokenService.CreateTokenAsync(request.CvDocumentId, request.Email, request.Language, request.Keywords, request.Location, request.ClientIpAddress, ct);
             return Ok(new CreateJobSearchTokenResponse { TokenId = tokenId });
         }
         catch (Exception ex)

Apis/cv-matcher-api/Services/Contracts/IJobTokenService.cs

@@ -19,7 +19,7 @@ public interface IJobTokenService
     /// The generated token ID to embed in the one-click job search link,
     /// or <c>null</c> when no job providers are currently enabled (link should be suppressed).
     /// </returns>
-    Task<string?> CreateTokenAsync(string cvDocumentId, string email, string language, IReadOnlyList<string> keywords, string? location, CancellationToken ct);
+    Task<string?> CreateTokenAsync(string cvDocumentId, string email, string language, IReadOnlyList<string> keywords, string? location, string? clientIpAddress, CancellationToken ct);
 
     /// <summary>
     /// Validates the token and, if valid, marks it as used and creates a <c>Pending</c> job search session.

Apis/cv-matcher-api/Services/JobTokenService.cs

@@ -34,7 +34,7 @@ public sealed class JobTokenService : IJobTokenService
     }
 
     /// <inheritdoc />
-    public async Task<string?> CreateTokenAsync(string cvDocumentId, string email, string language, IReadOnlyList<string> keywords, string? location, CancellationToken ct)
+    public async Task<string?> CreateTokenAsync(string cvDocumentId, string email, string language, IReadOnlyList<string> keywords, string? location, string? clientIpAddress, CancellationToken ct)
     {
         var hasEnabledProviders = await _db.JobProviders.AnyAsync(p => p.Enabled, ct);
         if (!hasEnabledProviders)
@@ -51,6 +51,7 @@ public sealed class JobTokenService : IJobTokenService
             Language = language,
             Keywords = string.Join(",", keywords),
             Location = location,
+            ClientIpAddress = clientIpAddress,
             ExpiresAt = DateTime.UtcNow.AddDays(_settings.TokenExpiryDays),
             Used = false,
             CreatedAt = DateTime.UtcNow