fix: hide unassessed jobs and cache gate rejections

[sangowu]

What changed

• default Web job list now returns only real non-skipped matches for the latest CV
• persist CV/JD/prompt-scoped relevance gate rejections
• preserve no-CV behavior and invalidate rejections on CV, JD, language, or prompt changes
• add cleanup coverage, regression tests, and documentation updates

Root cause

/api/jobs loaded the newest 200 raw cache rows and treated a missing match_score as visible. Relevance-gate rejection events were run-scoped only, so rejected cached jobs could reappear as unassessed and consume repeated model calls.

Impact

No fake zero scores and no bulk rescore. Existing unassessed historical rows are hidden by default; future gate rejections are reused only within their valid scope.

Validation

• 255 passed
• Ruff passed
• Python compileall passed
• frontend JavaScript syntax check passed
• isolated SQLite smoke passed