feat(research): add scoped user-approved opportunity and evidence research

[akoita]

Parent: #4

Outcome

Let the agents propose and perform narrowly scoped internet research when supplied opportunity or candidate sources are insufficient, while keeping every fetch visible, approved, provenance-bearing, and unable to invent candidate facts.

Scope

• Let the planner propose a research question, reason, source class, domains or URLs, data-transmission impact, and bounded fetch budget.
• Require an explicit user approval boundary before search or fetch.
• Keep opportunity/company research separate from candidate evidence and optional corroboration.
• Allow approved GitHub repositories, certification pages, authored articles, and similar public candidate resources to enter a selected knowledge base with provenance.
• Record query, approved scope, fetch time, source URL, extraction status, checksum, and user decision.
• Treat remote content as untrusted data and apply URL, size, timeout, redirect, content-type, and prompt-injection controls.
• Never turn company/job requirements or third-party speculation into candidate experience.
• Do not submit applications, message people, contact employers, or publish externally.

Acceptance criteria

• No web search or fetch occurs without visible per-research approval.
• The candidate can inspect, accept, reject, or delete fetched sources before use.
• Research failures and inaccessible sources are visible and recoverable.
• Candidate facts remain grounded in candidate-provided or explicitly accepted candidate resources.
• Opportunity context and candidate evidence have distinct source roles throughout planning and critique.
• Security tests cover SSRF, redirects, oversized content, unsupported content, prompt injection, and approval bypass.
• pnpm validate passes.

Dependencies

• feat(opportunity): assemble a reviewed opportunity brief from URLs and instructions #67 reviewed opportunity brief
• feat(knowledge): manage reusable candidate knowledge bases and source lifecycle #78 candidate knowledge-base lifecycle

[akoita]

Roadmap update: optional user-approved research is no longer on the v0.7 drafting critical path. It remains a planned capability after the source-grounded core workflow demonstrates parity; opportunity intake from explicitly supplied URLs and content remains in #67.