fix: deduplicate job source aliases

[sangowu]

What changed

• preserve cached sources, raw_sources, and date_posted during CV-triggered reassessment
• deduplicate Indeed and LinkedIn hostname aliases by provider during cache insert, merge, and read
• make existing cached rows render a single provider badge without re-scraping or re-scoring
• add regression coverage and update the changelog and bug-fix log

Root cause

The cached-job reassessment path omitted source metadata when calling write_cache. The fallback derived ie.indeed.com from the URL, while the original scraped source was indeed.ie. Cache merging compared the strings literally, so the UI received both values and rendered two identical Indeed badges.

Validation

• 89 passed in affected cache/new-feature suites
• 245 passed in the full test suite
• Ruff passed
• frontend JavaScript syntax check passed
• Python compileall passed
• git diff --check passed
• the existing Foxit cache row now reads as one Indeed source plus one LinkedIn source