feat(onboarding): implement candidate & recruiter onboarding completion flow

[Nirbhay21]

Summary

This PR implements the complete onboarding flow for both candidates and recruiters, including:

• Onboarding status management
• Candidate profile creation
• Recruiter profile creation
• Tag system with many-to-many relationships
• Row-Level Security (RLS) policies
• API key encryption for recruiters
• Validation layer using Zod
• Centralized error handling
• Authentication middleware and routes

Added

Backend Architecture

• /api/onboarding (GET, PUT)
• /api/me
• /api/health
• requireAuth middleware
• Global errorHandler middleware

Database tables

• user_onboarding
• candidate_profile
• candidate_profile_tag
• recruiter_profile
• recruiter_profile_tag
• tag

Relations

• User → onboarding (1:1)
• User → candidateProfile (1:1)
• User → recruiterProfile (1:1)
• Profile → tags (many-to-many)

Validation

• candidateOnboardingSchema
• recruiterOnboardingSchema
• onboardingUpdateSchema (discriminated union)
• Draft + full validation logic

Security

• AES encryption for recruiter llmApiKey
• ENCRYPTION_KEY added to env schema (min 32 chars)

Error Handling

• ApplicationError
• ValidationError
• Global Express error handler

Technical Changes

• Added Drizzle schema definitions with policies
• Enabled RLS on new tables
• Added createUserContext for RLS-aware transactions
• Updated tsconfig (nodenext module resolution)
• Removed import/order ESLint conflict
• Added crypto-js dependency
• Updated pnpm version

Notes

• Onboarding completion creates profile only once.
• Profiles are not upserted in this PR (onboarding-only behavior).
• Future PR will extract controller logic into service layer.