feat: keyword sets, sponsorship signals, and extractor/profile fixes

Add per-profile keyword sets, job source settings, sponsorship signal pills,
and several ATS extractors. Fix Hiring Cafe discovery via Next.js SSR search,
profile activate for comma-separated basicAuthUser aliases, and resume path
backfill migrations. Update settings and hiring-cafe docs; localhost compose
overlay for loopback-only deploys.

docs-site/docs/features/settings.md

@@ -153,6 +153,14 @@ Readiness requires:
   - Adzuna app ID/app key
   - Optional basic authentication for write operations
 
+### Job search profiles and local resume
+
+- **Search profiles** store target roles, deal-breakers, locations, and scoring context. Use the profile picker in Settings to create, switch, or activate a profile.
+- When **Basic Auth** is enabled, each login user maps to profiles whose `basicAuthUser` field lists that username. Comma-separated aliases are supported (for example `ilia,dobkin` accepts either login name).
+- Jobs are scoped per profile (`owner_profile_id`). Pipeline runs and the orchestrator board only show jobs for the profile tied to your current login.
+- **Local resume** JSON paths can be set per profile via `resumeLocalPath` in profile data (for example `../data/resumes/ilia-dobkin.json`). JobOps resolves that path relative to the orchestrator working directory when `JOBOPS_LOCAL_RESUME_PATH` is unset.
+- Activating a profile on Settings calls `POST /api/profiles/:id/activate` and updates `activeProfileId`, `jobSearchProfile`, and `localResumeProfilePath` when Basic Auth is off.
+
 ### Backup
 
 ![Backup settings section](/img/features/settings-backup-section.png)
@@ -260,6 +268,12 @@ curl -X POST "http://localhost:3001/api/backups"
 - Ensure `JOBOPS_PUBLIC_BASE_URL` is set for background/pipeline usage.
 - Ensure the configured host is publicly reachable and `/health` responds.
 
+### Profile activate returns 403 or jobs list is empty after login
+
+- Confirm your Basic Auth username appears in the profile's `basicAuthUser` list (comma-separated aliases are allowed).
+- If you previously ran pipelines before per-profile ownership existed, older jobs may still be under `__default__`. Re-run discovery while logged in, or migrate rows in `jobs.owner_profile_id` to your profile id.
+- Ensure the profile has `resumeLocalPath` pointing at an on-disk resume JSON if you rely on per-profile resumes without `JOBOPS_LOCAL_RESUME_PATH`.
+
 ## Related pages
 
 - [Company skip list](./company-skip-list)