Prod: expose vacancy applicant state and harden response access

[TThanos3000]

Source

Semantic production port of the missing parts from dev PR #712. Base: 5af826bbca59eede0183415032bf7de57a900673.

No dev -> master merge and no merge-commit cherry-pick were used.

What was missing in master

• Applicant-state UI hints in GET /vacancies/{id}/: has_responded, can_respond, can_manage_responses.
• Query annotations for response/collaborator state without serializer N+1 queries.
• Manager-only authorization and safe response contract for legacy GET /projects/{projectId}/responses/.

What was already in master and was preserved

• Safe response creation from request.user, duplicate/member/file validation.
• Vacancy-specific manager endpoint and safe public-profile serializers/selectors.
• Atomic accept/decline locking order, close/reopen/delete lifecycle.
• Notification and email lifecycle.
• Public catalog visibility/security and Vacancy.city.

Tests

Added production regressions for applicant state, leader/staff/superuser management, collaborator/outsider denial, safe legacy project responses, and existing create/manager contracts.

Local results:

• git diff --check — passed.
• Black/Flake8 for vacancy selectors/serializers/views/tests — passed.
• python -m compileall for changed files — passed.
• python manage.py check --tag models — passed.
• makemigrations --check --dry-run --skip-checks — No changes detected.
• Targeted test discovery: 35 tests; local execution is blocked because PostgreSQL is unavailable on localhost:5432.
• Full Django check is locally blocked by the missing system WeasyPrint gobject-2.0-0 library.
• projects/views.py retains a pre-existing origin/master Black/Flake8 baseline issue outside this PR's changed lines; no unrelated formatting was included.

GitHub PostgreSQL CI will verify the PostgreSQL vendor, select_for_update, migrations, targeted locking tests and the full backend suite.

Scope guard

No migrations, frontend, workflows, deploy or Docker changes. Vacancy catalog filtering, get_public_vacancies_queryset, datetime_created/date_create_time, list-card timestamps and list-button behavior are intentionally unchanged.