feat(hr/candidate-form): add public endpoints + fix email link generation
- new GET/POST /api/hr/public/candidate-form/{token} (no auth)
- bind frontend.url from config (was hardcoded url_prod)
- tolerant token lookup (URL-encoded fallback)
- map Field.name in FormsMapper
Closes VSN-2691