feat(scoring): eligibility gate (non_us_only) + absolute apply-URL resolution

- New jobs.eligibility column ('eligible' | 'non_us_only') set by the
  scorer: rule-based pre-filter (desc scan window 800 -> 6000 chars, new
  UK/Canada/right-to-work/IST patterns after Twilio slip-throughs) and a
  required ELIGIBILITY: line in the LLM prompt.
- non_us_only rows transition straight to archived; tailor/cover/apply
  queries, acquire_job, extension queue, get_stats, and the dashboard
  classifier all gate on eligibility.
- enrichment: resolve apply URLs to absolute via DOM el.href + urljoin
  fallbacks (fixes SimplyHired relative /out?r=... links).
- employers.yaml: disable ServiceNow/DocuSign/Uber Workday tenants
  (422/500 on probe; DocuSign moved to iCIMS, Uber pulled the tenant).