Address remaining security findings from source-code audit

- Restrict role-less endpoints: Postulaciones/Project write actions to
  SuperAdmin|Admin, Metricas/Dashboard reads to SuperAdmin|Admin|Reviewer|
  Auditor (matches actual frontend route guards, which never expose these
  to Employee/TI), and the admin sub-commands of /api/chat/comando
  (/actualizar ia, /estado ia) to SuperAdmin|Admin|TI.
- WorkerController: index() now rejects Employee entirely (browsing all
  candidates was never part of that role), show()/store() now enforce the
  same self-or-privileged-role check already used by update()/destroy().
- AvatarController: validate uploaded images by real MIME type
  (mimes+mimetypes) instead of trusting the client-supplied extension.
- AdminUsersController::store: require the same strong password policy
  (letters+mixedCase+numbers+symbols+uncompromised) already enforced by
  UserController, instead of a bare min:6.
- AuditLogController::store: restrict the client-reported 'accion' to an
  explicit allow-list instead of any string up to 100 chars, so a caller
  can no longer forge arbitrary audit-log entries.
- Add input validation to the 8 catalog controllers (Gender,
  ProfessionalLevel, LevelStudy, LevelState, Lenguages, LevelLenguages,
  TypeContract, HvState) store/update, which previously accepted any
  payload behind only a role check.
- EmbeddingService: bind the vector/user_id/limit values in the two raw
  SQL statements instead of interpolating them into the query string.
  Not previously exploitable (values were already server-controlled),
  but removes the fragile pattern.
- Stop tracking the two backend .zip backups committed to the repo and
  add *.zip to .gitignore. Files are kept on disk, only untracked going
  forward; this does not purge them from git history. If those archives
  contain a .env or DB dump, treat any credentials inside as compromised
  and rotate them, and consider a history rewrite (git filter-repo) plus
  force-push separately — not done here since it rewrites shared history.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
