DEV: harden vacancy responses and expose applicant state

[TThanos3000]

Scope

Semantic port of the vacancy-response lifecycle from production behavior onto current dev without merging master.

• creates responses exclusively for request.user and rejects unavailable vacancies, project leaders, collaborators, duplicates, and foreign files;
• exposes manager-only safe response lists for a vacancy and the legacy project endpoint;
• adds has_responded, can_respond, and can_manage_responses to vacancy detail;
• makes accept/decline transaction-safe, closes the vacancy, creates one collaborator, and rejects other pending responses;
• preserves the existing self-response contract and asynchronous email callbacks;
• documents permissions, response contracts, and lifecycle rules.

Verification

• GitHub CI Lint: passed.
• GitHub CI full suite: 543 tests passed, 1 skipped, in 209.967s.
• The current PR workflow uses its configured SQLite test database. Local PostgreSQL execution was attempted but PostgreSQL is unavailable on localhost:5432; no SQLite substitution or settings change was made locally.
• Targeted suite discovery: 34 tests; all are included in the successful full CI suite.
• Black check for all changed vacancy Python files: passed.
• Flake8 for all changed vacancy Python files: passed. GitHub CI repository-wide Flake8: passed.
• python manage.py check --tag models: passed.
• python manage.py check: locally blocked by missing WeasyPrint gobject-2.0-0 system library.
• makemigrations --check --dry-run --skip-checks: No changes detected.
• python -m compileall projects vacancy: passed.
• git diff --check: passed.

Scope confirmation

• Base: dev at 5fc11e4.
• No master-to-dev merge or broad cherry-pick.
• Vacancy.city and migration 0010 remain present.
• Existing dev deployment fixes remain in the base and are unchanged by this PR.
• No migrations added.
• React, Angular, workflows, deploy, Docker, and unrelated backend modules were not changed.