Enterprise MVP portals, reliable AI interview audio, and DNLA release lock

[UmerkhanGolandaz]

Summary

• Implement the institute, recruiter, super-admin, and student enterprise MVP workflows.
• Separate workspace pages and canonical role-aware routing.
• Add organisation approval, controlled institute-company access, recruiter governance, jobs, candidate consent, reports, credits, and verified reports.
• Harden interview evidence, paid-attempt idempotency, Firestore access, and tenant boundaries.
• Restore reliable cross-browser AI interview audio: server-generated Gemini PCM interviewer speech plus authenticated MediaRecorder transcription for Chromium, Firefox, and Safari.
• Recover blocked/expired interview sessions cleanly by rotating to a fresh paid attempt instead of replaying terminal state.
• Keep technical and AI behavioural interviews available for testing.
• Fail closed for DNLA, test TANs, provider calls, DNLA credits, and verified Fit Score until an explicit future release.

Root causes fixed

1. The Face ID dialog hid an HTTP 409 allocation rejection behind its captured-image success state, making the start button appear unresponsive. The approval transaction also skipped entitlement creation for self-registered candidates without an institute or company owner.
2. Enterprise hardening disabled browser-direct Gemini Live audio without an equivalent cross-browser replacement. The text path returned empty server audio, fell back to OS speech synthesis, and depended on Web Speech recognition that Firefox does not provide. This caused the robotic/noisy interviewer and unavailable microphone.

The repaired verified interview transport persists authoritative text turns server-side, synthesizes natural 24 kHz PCM speech only after persistence, records one noise-suppressed mono candidate answer at a time, and transcribes it through an authenticated owner/session-bound route. The failed production technical attempt was restored through the normal audited admin service-request workflow; behavioural and DNLA allocations were not changed.

Release controls

• DNLA_ENABLED=false
• NEXT_PUBLIC_DNLA_ENABLED=false
• DNLA_TEST_MODE_ENABLED=false
• DNLA provider/TAN secrets are not bound.
• Cost-bounded App Hosting scaling: minimum 0, maximum 10, concurrency 20.
• Production TTS model: gemini-2.5-flash-preview-tts.

Validation

• 133/133 automated tests passed.
• Focused interview repair suite passed.
• TypeScript passed.
• Production Next.js build passed (79 routes).
• git diff --check passed.
• Live TTS PCM round-trip transcribed the generated sentence exactly.
• Production authenticated terminal-session and transcription gates returned the expected contracts.
• Production and local App Hosting health checks returned HTTP 200.

Deployment

Firebase App Hosting rollout build-2026-07-28-004 succeeded and is serving exact commit 6197bbffa9135e170137183d90f17be62cb18eff.