feat: add safe application packet CLI

[bricenice17]

Summary

• Add a safe, Todoist/Telegram-friendly packet generation service and CLI (python -m packet_cli).
• Support selected job id, existing job URL lookup, or highest-score stored job lead selection.
• Write recoverable per-job artifacts: resume, cover note, application answers, audit record, summary Markdown, and packet index.
• Enforce dry-run/no-submit guardrails; no ATS browser filling or external application submission.
• Validate reused resume/cover paths; stale asset paths regenerate Markdown handoff artifacts instead of claiming recovery for missing files.

Verification

• uvx --with pydantic pytest backend/tests/test_packet_cli.py -q — 6 passed before review; after stale-asset regression, covered in combined run below.
• uvx --with pydantic pytest backend/tests/test_packet_cli.py backend/tests/test_generation_service.py -q — 12 passed
• python3 -m compileall -q backend/application_packets.py backend/packet_cli.py
• Isolated CLI smoke with temp JHM_APP_DATA_DIR: uv run --with pydantic python -m packet_cli --high-score --min-score 90 --output-root "$TMPDIR/packets" --format both returned job_id=high-amz, dry_run=true, submitted=false, summary/audit/index files exist.
• Submit guard: uv run --with pydantic python -m packet_cli --submit exits 2 with external submission is not supported in the packet CLI.

Notes

• This phase intentionally does not implement ATS browser filling or application submission.
• This PR only commits packet CLI files; the local worktree has unrelated pre-existing unstaged ranking/discovery changes that are not included.

[vercel]

@bricenice17 is attempting to deploy a commit to the Vasu-Devs' projects Team on Vercel.

A member of the Team first needs to authorize it.

[bricenice17]

Closing because this PR was opened against the wrong repository/workstream. No merge intended.